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EXECUTIVE SUMMARY 

Top Officials (TOPOFF) 4 (T4) is the fourth in the series of congressionally mandated, biennial, 
national homeland security preparedness exercise activities designed to train and test national 
decision makers and to use resources of multiple departments and agencies (D/As). Beginning 
with the T4 Command Post Exercise (CPX), T4 involves a series of activities dealing with 
teiTorism prevention, incident management, intelligence-handling and investigation, public 
information, and evaluation. The T4 CPX serves to address the national counterterrorism 
strategy; exercise the national ability to prevent, respond to, and recover from a weapon of mass 
destruction (WMD) incident; and engage senior Federal officials. 

Sponsored by the Department of Homeland Security (DHS) Office of Grants and Training 
(G&T), the 2006 T4 CPX was held on June 19-22, in conjunction with the Federal Emergency 
Management Agency (FEMA)-sponsored Forward Challenge 2006 (FC 06) and Federal Bureau 
of Investigation (FBI)-sponsored Marble Challenge 2006-02 (MC 06-02) exercises. Over 60 
D/As participated in the exercise, along with private sector organizations and State and local 
officials from Virginia, Maryland, and Washington, DC. Officials from Portland, Oregon, and 
Guam participated in the exercise simulation cell (SIMCELL). 

The evaluation of the exercise focused on three general areas: WMD response, situational 
awareness and information sharing, and public information. Within each of these areas, several 
key issues emerged and are addressed in this after- action report (AAR). 

Focus Areas and Key Issues 

WMD response 

• Some predetonation decisions/actions may have compromised operational security. 

• Protective actions/recommendations were not coordinated with State and local governments. 

• The May 25 National Response Plan (NRP) notice of change was not fully implemented. 

• The deployment of Federal and volunteer personnel was limited by WMD contamination. 
Situational awareness and information sharing 

• Federal D/As and the NCR did not share situational awareness. 

• Intelligence was not consistently shared across Federal D/As and the National Capital 

Region (NCR). 

Public information 

• Conflicting guidance was provided to Federal government employees and the public before 
the WMD blast. 


We summarize each issue below and follow with a list of suggested corrective actions. It is 
important to note that exercise artificialities and implementation issues affected the exercise and 
the key issues discussed in this report. Although the White House and Homeland Security 
Council were engaged in the planning process, they did not participate in the exercise, which 
affected the decision-making process. Other artificialities, such as differing levels of play by 
participants, limited coordination among the Federal interagency and between the Federal 
interagency and the NCR. 
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Some predetonation decisions/actions may have compromised operational security. 

During the T4 CPX, several predetonation decisions and actions could have compromised 
operational security, notably, implementing the continuity of government condition (COGCON) 
Level 1, raising the HSAS level, and implementing the Catastrophic Incident Annex (CIA) of the 
NRP. Federal law enforcement and intelligence personnel assume that terrorists would alter their 
plans if they thought they were compromised. For example, terrorists might advance their 
timetable for detonation, alter their plan to strike at secondary targets, destroy evidence of their 
activities, flee in an attempt to escape without completing their mission, or discard or hide the 
device for later retrieval. The COGCON level elevations were scripted both in this exercise and 
in a previous DHS tabletop exercise for senior officials, Vulcan Warrior^ that examined the 
issue of operational security in a WMD scenario. Participants in Vulcan Warrior did not support 
the scripted COGCON Level 1 decision because they fell the activities associated with 
COGCON Level 1 could not be carried out without alerting the ten'orists. 

DHS should collaborate with the intelligence community and State and local governments to 
examine these decisions and actions and identify potential alternatives to COGCON Level 1 in 
this type of scenario. In addition, operational security issues should be addressed in NRP 
supporting policies and procedures. 

Protective actions/recommendations were not coordinated with State and local governments. 

During the T4 CPX, several key protective actions/recommendations were not coordinated with 
NCR jurisdictions, most notably increasing the COGCON level to 1 , raising the HSAS to Red, 
and evacuating Prince George’s County, Maryland. Thus, the NCR was unable to participate in 
the development of protective actions and examine how they would be implemented in 
coordination with the Federal government. It is likely that the lack of participating senior 
leadership; different levels of commitment among Federal, State, and local (FSL) D/As to the 
CPX; and misunderstandings about exercise design all contributed to the artificial decision- 
making process. Future exercises should focus on the coordination of protective actions with 
State and local officials. 

The May 25 NRP notice of change was not fully implemented. 

The National Operations Center (NOC), Incident Advisory Council (lAC), and the NOC 
planning element are new entities replacing the Homeland Security Operations Center (HSOC) 
and Interagency Incident Management Group (IIMG). The supporting policies and procedures 
for these entities have not yet been developed. Because the membership for the I AC has not been 
established, members of the IIMG played as the I AC Transition Team. The NOC participated 
fully, but has not increased in size beyond the HSOC. The NOC planning element was not yet 
established. 

Because these changes came only weeks before the exercise , personnel had little information 
about what their new roles were and how they should interact within the larger response 


\ Senior Official Exercise (SOE) 05-4, held in May 2004. 

^ They were established in the May 25, 2006, notice of change to Ihe NRP. 
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structure. Planning efforts are underway to develop the supporting doctrine. In addition, DHS 
should educate the emergency response community about the role of these new structures and 
how they are implemented. 

The deployment of Federal and volunteer personnel was limited by WMD contamination. 

It was unclear who was responsible for determining what areas were considered safe when 
Federal D/As were making plans to deploy personnel and other resources into the affected area. 
For example, the American Red Cross (ARC) was concerned about deploying volunteer 
personnel to staff shelters and other sites, and some D/As disagreed about where mobilization 
centers should be located. The simulation of Federal field response teams likely contributed to 
this problem. 

A coordinated strategy for staging and deploying responders, and ensuring they were not 
exposed to unsafe levels of contamination was not evident during the exercise. This 
responsibility should be clarified to ensure consistent protective actions are employed across the 
response effort. 

Federal D/As and the NCR did not share situational awareness. 

Despite efforts to improve communications and information sharing across Federal D/As, they 
all lacked a shared situational awareness of key information during the T4 CPX. According to 
the NRP, the NOC is responsible for providing a general domestic situational awareness and a 
common operational picture. According to the HSOC SOP, the HSOC (now called the NOC) 
provides information to D/As through a variety of communications links including the Homeland 
Security Information System (HSIN). 

The NOC Common Operating Picture (COP), a new component of HSIN, was not available for 
this exercise. Furthermore, other methods of communicating this information did not appear to 
be used in its place. Thus, Federal D/As and NCR organizations gathered information from many 
different sources, resulting in varied understandings about key information during the exercise. 
The decisions made in Secure Video Teleconference (SVTC) meetings were not formally 
documented and disseminated, which contributed to the problem. 

The COP has the potential to improve information sharing and situational awareness across FSL 
D/As. DHS should ensure that D/As are able to access and use the system, that there are 
redundant methods for sharing information, and that D/As are able to assimilate this information 
into a shared situational awareness. 

Intelligence was not consistently shared across Federal D/As and the NCR. 

There were differences in the intelligence information available at Federal D/As and within the 
NCR during the exercise. Whereas some D/As received detailed information about the threat in 
the NCR and Landport, others received little or no information. The location of personnel in 
secure and nonsecure sites contributed to these problems because classified information can only 
be transferred through secure phones or computer systems. Even when personnel in nonsecure 
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sites had clearance to receive the information, they often did not have access to secure phones or 
computer systems. The ability of some Federal D/As and the NCR to take protective actions and 
prepare their response to a nuclear/radiological incident was affected by this lack of information. 
DHS should coordinate with the intelligence community to further assess and address this issue. 

Conflicting guidance was provided to Federal government employees and the public before the 
WMD blast. 

One of the most important requirements during emergencies is to provide the public with 
protective action guidance. During the T4 CPX, conflicting protective action guidance was 
provided to Federal government employees and the public in the NCR and in Landport before 
the WMD blast. The likely outcome would be public confusion in the NCR and in Landport 
before the WMD blast and frustration with the Federal D/As. 

Although there is a balance between protecting operational security and providing information to 
the public, information passed to nonessential government personnel, at a minimum, must also 
be relayed to the public. Nonessential government workers will likely call their families and 
friends once an announcement is made, thus assuring that the larger public will know something 
unusual is occutring. Therefore, DHS should work with 0PM to develop a standardized 
emergency leave policy for nonessential government personnel with an elevation to COGCON 
Level 1 so that it is consistent among all D/As and is also consistent with expected guidance to 
the public. 

Federal D/As were able to “speak with one voice” after the WMD detonation in Landport. 
However, it is important to recognize that in a real WMD emergency the public will look to their 
State and local governments first for protective action guidance. Therefore, Federal D/A 
guidance must be consistent with that provided by the State and local public affairs agencies. 

This has proved to be a significant challenge in previous TOPOFF exercises and was not 
examined during the T4 CPX. This issue should be readdressed during the full-scale exercise. 

Corrective Actions 

The following corrective actions were developed in coordination with a small group of 
interagency T4 CPX planners. They are intended to be further refined by DHS and the larger 
interagency into a corrective action plan and are described in more detail in Appendix B. 


WMD response 

• Conduct pre-exercise training and education for senior leadership. 

• Write exercise concept of operation plans (CONPLANs) for senior leadership. 

• Expand pre-exercise participant training. 

• Develop alternatives to COGCON Level 1 in the COOP architecture. 

• Create additional measures in COOP plans to minimize impact on local communities. 

• Develop an interagency play book for NRP. 

• Write operational plans for catastrophic scenarios. 

• Collaborate with the NCR to address protective action coordination. 

• Establish SOPs for the lAC and NOC. 


IV 
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• Establish procedures for publicizing changes to the NRP. 

• Develop a training and education program for the NRP. 

• Clarify the responsible entity for providing guidelines for deployment into potentially 

contaminated areas. 

Situational awareness and information sharing 

• Finish development and deployment of the COP. 

• Develop parameters and standards for the COP, to include spot reports and SITREPS. 

• Establish video teleconference protocols for incidents of national significance. 

• Develop D/A-specific policies and procedures for HSIN. 

• Conduct a feasibility study of integrating HSIN with web-EOC. 

• Review intelligence sharing procedures. 

• Develop reachback alternatives for senior leadership. 

• Ensure that all COOP facilities have SCIFs and can share information at the same level of 
classification. 

• Develop a process for linking the National Infrastructure Coordination Center (NICC) with 

public messaging during an emergency. 

Public information 

• Analyze options for a dynamic public messaging system and integrate with Integrated Public 
Alert and Warning Systems (IPAWS) work. 

• Standardize leave policy for nonessential government personnel in an emergency. 

• Develop D/A-specific HSAS play books. 
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1.0 EXERCISE OVERVIEW 

1.1 Background 

Top Officials (TOPOFF) 4 (T4) is the fourth in the series of congressionally mandated biennial 
national homeland security preparedness-related exercise activities designed to train and test 
national decision makers and to use resources of multiple departments and agencies (D/As). 
Beginning with the T4 Command Post Exercise (CPX), T4 involves a series of activities dealing 
with terrorism prevention, incident management, intelligence-handling and investigation, public 
information, and evaluation. The T4 CPX serves to address the national counterterrorism 
strategy; exercise the national ability to prevent, respond to, and recover from a weapon of mass 
destruction (WMD) incident; and engage senior Federal officials. 

Sponsored by the Department of Homeland Security (DHS) Office of Grants and Training 
(G&T), the 2006 T4 CPX was held on June 19-22, in conjunction with the Federal Emergency 
Management Agency (FEMA)-sponsored Forward Challenge 2006 (FC 06) and Federal Bureau 
of Investigation (FBI)-sponsored Marble Challenge 2006-02 (MC 06-02) exercises. Over 60 
D/As participated in the exercise, along with private sector organizations and State and local 
officials from Virginia, Maryland, and Washington, DC. Officials from Portland, Oregon, and 
Guam participated in the exercise simulation cell (SIMCELL). Figure 1 lists all T4 CPX 
participants. 


Figure 1. T4 CPX Participating Organizations 
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1.2 Scenario 

The T4 CPX scenario was derived from National Planning Scenaiio (NPS) 1 — Weapons of Mass 
Destruction (WMD) Detonation — and its associated Universal Adversary (UA) threat models. 
Comprising 15 scenarios of plausible terrorist attacks and natural disasters, the NPS series serves 
to yield core prevention and response requirements to help direct comprehensive preparedness 
planning efforts. The UA is a fictitious adversary for general exercise use. 

Designed to achieve the objectives of all three exercises (T4 CPX, FC 06, and MC 06-02), the 
scenario involved the acquisition of two WMD from the former Soviet Union arsenal by UA 
terrorists associated with radical Sunni groups. The terrorists smuggled the weapons into the 
United States in separate shipments. One WMD was trucked across the southern border and 
intended for detonation in the National Capital Region (NCR). Intelligence regarding this 
weapon drove the U.S. government to initiate Continuity of Operations (COOP) procedures. The 
other WMD arrived in the fictitious coastal city of Landport, Central Pacifica (CP) via charter 
vessel and was detonated in port upon detection. 

1.3 Exercise Concept 

A prevention and response-focused exercise, the T4 CPX was driven by events and intelligence 
from a Master Scenario Events List (MSEL) simulating domestic terrorist incidents in the NCR 
and the notional city of Landport, CP. The principle training audience included D/A senior 
officials and staff, multicoordination centers (e.g., Incident Advisory Council flACl^ Transition 
Team), and the DHS National Operations Center (NOC)^ personnel. Designed to capitalize on 
lessons learned from prior TOPOFF and Senior Officials Exercises (SOEs), the T4 CPX tested 
and evaluated policies and procedures outlined in the National Response Plan (NRP) and 
National Incident Management System (NIMS). 

1.4 Evaluation Methodology 

The evaluation approach for the T4 CPX is based on the methodology outlined in HSEEP 
Volume II and the methodology used in previous TOPOFF exercises. It uses observation/data 
collection, reconstruction, and analysis to determine what happened in the exercise and to 
develop findings and recommendations. 

The analysis focuses on interagency issues and coordination as put forth in the NRP, NIMS, and 
supporting protocols. This analysis and after-action report (AAR) does not look at D/A specific 
tasks, procedures, or performance. D/As are encouraged to conduct their own evaluation and 
analysis of their exercise performance for internal use and dissemination. 

The methodology uses the following three-step process: 

1. Observation/data collection collects the data necessary to reconstruct exercise events. 

2. Reconstruction compiles and synchronizes the data to determine what happened and 
when. 


^ The Incident Advisory Council replaced the Interagency Incident Management Group (IIMG). 
The National Operations Center replaced the Homeland Security Operations Center (HSOC). 
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3. Analysis uses the reconstruction to provide findings and recommendations related to the 
exercise objectives. 

See the Evaluation Plan (Annex G of the Exercise Plan [EXPLANJ) for a detailed description of 
this methodology. In addition to examining the overarching objectives, we selected several focus 
areas of analysis for the T4 CPX, shown in Table 1. These areas are derived from specific 
exercise objectives and were chosen because they meet one or more of the following criteria: 

• Identified as an unresolved issues in past TOPOFF exercises 

• Identified as an issue during the response to Hurricane Katrina 

• Relevant to the T4 CPX scenario 

Table 1. Focus Areas of Analysis 


Focus Area 

T4 CPX Objectives 

Mission 

WMD response 

Test existing procedures for domestic incident 
management of a ten'orist WMD event and top 
officials’ capabilities to respond in partnership in 
accordance with the NRP and NIMS. 

Exercise the authorities, responsibilities, and 
capabilities of the Federal assets necessary to respond 
to a terrorist WMD incident. 

Execution of 
Federal 
authorities, 
responsibilities, 
and decision 
making during a 
WMD incident 

Situational 
awareness and 
infonnation sharing 

Test the ability of command/operations/intelhgence 
centers to share intelligence and information and 
maintain a common operational picture (COP). 

Multiagency 

coordination 

Public information 

Exercise the coordination of a domestic and 
international media and public communications 
strategy and public messaging in the context of a 
terrorist WMD incident. 

Coordination of 
public 

communications 
strategy and 
public 
messaging 


A quick-look report was prepared within 72 hours of the exercise and was based on immediate 
feedback from the exercise hot wash. As part of the data collection process, DHS requested that 
participants submit their lessons learned and comments on the quick-look report by July 15. 
Appendix C includes a list of participants who submitted responses, along with a compilation of 
lessons learned. 

Following the analysis of each issue, suggested corrective actions are presented. These actions 
were developed in coordination with a small group of interagency T4 CPX planners. They are 
intended to be further refined by DHS and the larger interagency into a corrective action plan. 
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1.5 Exercise Artificialities 

The following artificialities and constraints were used to accomplish the exercise objectives: 

• Weather and atmospheric conditions for notional locations in the exercise were based on 
historical weather patterns to create a specific dispersal pattern of the agents involved in 
the exercise event. This was necessary to drive exercise play to meet the agreed upon 
overarching and agency-specific exercise objectives determined during the T4 CPX 
planning process. 

• There were vai'ying levels of play among senior officials, and surrogates played in place 
of some key decision makers. The Homeland Security Council (HSC) Counterterrorism 
Support Group (CSG) did not participate in the exercise as planned. Senior leader Secure 
Video Teleconference (SVTC) meetings were held in place of the CSG meetings to 
simulate the decision making that would have occurred during these meetings. The level 
of play among D/As varied as well and is described in the EXPLAN. 

• D/As and organizations not participating in the T4 CPX were simulated through the 
Simulation Cell (SIMCELL), These included much of the Department of Defense (DoD), 
FEMA Region X, and State and local officials of Landport and Central Pacifica. The 
SIMCELL representation of nonparticipating agencies was determined by the agencies’ 
published policies, procedures, doctrine, and requests for information (RFls) developed 
during the planning process. 

In addition to the aitificialities the following exercise implementation issues impacted play: 

• During the T4 CPX, the Intelligence Control Cell (ICC) was not collocated with the 
Master Control Cell (MCC) and did not operate around the clock. 

• Some participants were not aware who was participating and who was not or how to 
interact with the SIMCELL. 

• Some field entities such as the HHS Regional Emergency Coordinators (RECs) were not 
simulated. 

• Some D/As were not participating in all exercises (e.g., participating only in FC 06) or 
gave one of the exercises priority by limiting play in the others. 

Along with the artificialities, these issues had the following impact on play: 

• Key decision-making activities were simulated or carried out at a lower level of authority, 
and there was no final adjudicator present. Decisions were also not coordinated with the 
NCR players. 

• There was limited Federal interagency and Federal-NCR coordination in exercise play. 
For example. Emergency Support Function (ESF) #12 (Energy) and ESF #13 (Public 
Safety and Security) did not send representatives to the NRCC. This limited the NRCC’s 
ability to respond to ESF #12 and ESF #13 issues and to coordinate with the Department 
of Energy (DOE), which was the coordinating agency under the NRP nuclear/radiological 
incident annex in this scenario. 

• Players had difficulty communicating and coordinating with simulated organizations. For 
example, participants in the NRCC were not initially aware that Region X was being 
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simulated. Later, they did learn how to eontact the SIMCELL and were able to interact 
with a simulated Region X. 

• There was limited involvement from Federal D/As and the NCR in public information 
play, and no one actually acted as the State and local counterpart for Landport. In 
addition, the National Joint Information Center (NJIC) never received any guidance from 
White House Communications or from the HSC. 

As described in Table 2, DHS has developed corrective actions to ensure better senior leader 
participation in future TOPOFF exercises. 

Table 2. Exercise Participation: Suggested Corrective Actions 


Corrective 

Action 

Description 

Responsible 

Agencies 

Timeline 

Conduct pre- 
exercise training 
and education for 
senior 
leadership. 

Conduct training and education for senior leaders 
prior to the next Full Scale Exercise (FSE) to 
ensure they are engaged and have full awareness of 
their anticipated role. 

DHS— 

Preparedness 

Directorate 

6 Months 

Write exercise 
CONPLANs for 
senior 
leadership. 

Write a concept of operations (CONPLAN) for the 
next FSE. Senior leadership would be the target 
audience, and the intent would be to provide them 
with a description of their roles and responsibilities 
during the exercise. 

DHS— 
Prep tiredness 
Directorate 

6 Months 

Expand pre- 
exercise 
participant 
training. 

Expand the training and infonnation materials 
provided to players and field controllers to ensure 
they are aware of the expectations for coordination 
and interaction with participating and simulated 
organizations. 

DHS— 

Preparedness 

Directorate 

12 

Months 
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2.0 EXERCISE GOALS AND OBJECTIVES 

2.1 Goals 

T4 was designed to train and test national decision makers and to use resources of multiple D/As 

in homeland security preparedness. The overarching goals of T4 are as follows: 

1. Prevention: To test the handling and flow of operational and time-critical intelligence 
between agencies to prevent a terrorist incident. 

2. Incident management: To test the full range of existing procedures for domestic 
incident management of a terrorist WMD event and to improve top officials’ 

(Federal/S tate/local) capabilities to respond in partnership in accordance with the NRP 
andNIMS. 

3. Intelligence/investigation: To test the handling and flow of operational and time-critical 
intelligence between agencies prior to and in response to a linked terrorist incident. 

4. Public information: To practice the sti'ategic coordination of media relations and public 
information issues in the context of a terrorist WMD incident or Incident of National 
Significance. 

5. Evaluation: To identify lessons learned and promote best practices. 

2.2 Objectives 

The T4 CPX objectives were as follows: 

1 . Examine the effects of implementing continuity programs in the context of a credible 
terrorist WMD threat. 

2. Exercise and validate D/As’ Continuity of Operations (COOP) plans, procedures, and 
policies. 

3. Exercise the coordination of a domestic and international media and public 
communications strategy and public messaging in the context of a terrorist WMD 
incident. 

4. Test existing procedures for domestic incident management of a terrorist WMD event and 
top officials’ capabilities to respond in partnership in accordance with the NRP and 
NIMS. 

5. Exercise WMD render safe operations. 

6. Exercise the authorities, responsibilities, and capabilities of the Federal assets necessary 
to respond to a terrorist WMD incident. 

7. Examine the handling of mental health and special needs issues that may arise during and 
after a terrorist WMD event. 

8. Examine emergency operations planning and citizen protection capabilities in response to 
a terrorist WMD incident. 

9. Examine public health, medical support, mass decontamination, and mass care 
requirements during a terrorist WMD incident. 

10. Test the ability of command/operations/intelligence centers to share intelligence and 
infonnation and maintain a COP. 
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3.0 EXERCISE EVENTS SYNOPSIS 


The T4 CPX scenario involved two WMDs; one was located and rendered safe in the NCR, and 
the other detonated in Landport, CP. The following is a reconstruction of injects, decisions, and 
actions from June 19 through June 22, 2006. It is based on the logs and supporting data collected 
by data collectors stationed at key locations during the exercise. It is a factual recount of the 
decisions and actions as they unfolded during the exercise. Some of these events deviated from 
what was expected by the exercise planners, An overview of the key events is shown in Figure 2. 


Figure 2: T4 CPX Key Events 



3.1 June 19, 2006 

The White House ordered the move to COGCON 3 at 4:00 p.m. D/As were required to assume 
COOP activities for COGCON 3 by 8:00 a.m. on June 20. 


At a 6:00 p.m. meeting, the NCR Senior Policy Group discussed the possibility of a threat to the 
region and decided to implement nomial 4th of July protective measures. It convened an incident 
action planning meeting the next morning. 


Following an attempt to photograph port security measures and on-duty customs agents in 
Landport, CP, Pakistani- American student and radical Muslim Karim Mohammed Butt was 
confronted by building security, and arrested hy the Landport Police Department at 7:00 p.m.. 
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The FBI Joint Terrorism Task Force was notified, and they began interrogating Butt. He revealed 
that he knew Jaffar bin-Husseini, a Pakistani -American and fellow Islamic radical charged with 
executing operations in Landport, but he did not provide any information about the terrorist plot, 

3.2 June 20, 2006 

Local authorities and the FBI confirmed Butt’s identify. Butt hinted that the device had a 
radioactive component. At 5:00 p.m., law enforcement officers located several empty containers 
with traces of heroin, one lead-lined container, and a USB device in a warehouse in New Dayton, 
Maryland. 

DHS hosted a SVTC at 5:00 p.m. to discuss possible threats in the NCR. The participants, who 
included the DHS Secretary, discussed releasing the WMD intelligence to the mayors of five 
potentially targeted cities. They also proposed a snow-day type response to limit persons in the 
cities and prevent morning commutes. The Department of State reported that it had approached 
Russia for information on any missing weapons, and the FBI reported that it would begin 
searching for a possible WMD in the NCR, Participants decided to increase the readiness levels 
of response assets and to go to COGCON 2'''; the order was given at 7:16 p.m. 

The FBI and DOE began searching the NCR at 7:00 p.m. 

3.3 June 21, 2006 

3.3.1. 5:00 a.m.-12:00 pm. 

At 5:00 a.m., the FBI confirmed the intelligence on a WMD threat in the NCR, resulting in the 
DHS order to go to COGCON 1 by 9:00 a.m. The FBI located the device in New Dayton, MD^, 
and deployed assets to the site by 9:00 a.m. 

By 7:47 a.m., a domestic threat conference call was convened. Participants learned that a WMD 
had been located in the NCR. 

At 8:00 a.m.. State and local NCR emergency management offices began activating and tracking 
the incident and response activities. 

During an 8:30 a.m. SVTC that ended about an hour later, participants decided to raise the HSAS 
level to Red for the NCR and Orange nationwide, and evacuate Prince George’s County. This 
prompted a discussion of who has the authority to call for such an evacuation. In addition, the 
DHS Secretary decided to invoke the Catastrophic Incident Annex of the NRP and stated that he 
planned to declare a classified Incident of National Significance. 

At about 9: 14 a.m., the lAC discussed the intelligence it had on the two WMDs, which said one 
was in the NCR and a second was potentially in Landport. At 10:05 a.m., DNDO participants 


^ Increasing the COGCON level to 1 was also discussed, but the increase to COGCON 2 was chosen in part because 
it was pre scripted. 

^ This was a notional location for Clinton, MD. The Marble Challenge field exercise was carried out at another 
location. 
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also discussed intelligence suggesting Land port as a second target. The NOC had just received 
WMD threat modeling for the NCR and continued working on an analysis tor other potentially 
targeted areas. 

At 9:00 a.m., VNN reported that an exodus of Federal employees from Washington, DC, was 
causing traffic delays, and that there were rumors of Federal government relocation. VNN 
confirmed these rumors at 9:53 a.m., reporting that the Federal government was indeed 
undergoing COOP activities. 

There had been growing speeulation all morning among participants regarding whether the 
Office of Personnel Management (0PM) would release Federal employees; there had still been 
no decision at 8:45 a.m. At 10:05 a.m., the 0PM directed all Federal employees within a 15-mile 
radius of Clinton, MD, to evacuate.^ 

At 9:54 a.m., personnel working in the NJIC were told a “snow day” order was in effect for 
Landport and began working on press releases that explained what was happening in both 
Landport and the NCR. 

When ESF#1 (Transportation) personnel working in the National Response Coordination Center 
(NRCC) learned that an evacuation of Prince George’s County was underway at about 10:30 
a.m., they inquired whether Federal assistance was required. Later they were told that the 
evacuation was being handled locally and that no Federal assistance was needed. The NRCC also 
reported at 10:30 a.m. that the Domestic Emergency Support Team had (notionally) deployed to 
the NCR. 

VNN reported at 10:45 a.m. that there was a threat to the Washington, DC region. At 10:55 a.m., 
it reported that the HSAS level for Washington DC had increased to Red, and the nation to 
Orange. 

During the National Incident Communications Conference Line (NICCL) call at 9:54 a.m., snow 
day declaration and shelter-in- place orders were reported to be in effect for Landport. At 1 1 :03 
a.m., the 0PM director directed Federal employees within a 15-mile radius of Landport, CP, to 
evacuate and seek shelter north of the area. 

Back in the NCR, DHS issued a press release at 11:11 a.m. on the evacuation of Prince George’s 
County, MD and the elevation of HSAS levels. At 1 1:30 a.m., the DC mayor issued an 
emergency declaration, and FEMA reported that FIRST, ERT-N, NDMS, and US&R teams had 
been activated and deployed to East and West Coast mobilization centers. 

With the WMD aboard, Husseini attempted to dock in Landport at 1 1 :00 a.m. The number of law 
enforcement in the area and continuous news reports on television made Husseini increasingly 
nervous. He decided to arm the weapon and called Butt repeatedly, but to no avail. 


^ 0PM may have been acting on knowledge of the scenario rather than the current intelligence information that was 
in play. 
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Husseiiii’s attempt to dock his yacht at this location arose suspicion among CBP officers, who 
began boarding and searching the vessel. When their radiation identifier registered multiple 
neutron readings, the officers contacted the Laboratory Scientific Services and attempted to 
transmit the data. At the point of detection, Husseini detonated the device using his cell phone, 
causing a low yield detonation. 

3.3.2. 12:00 p.m.-l2:00 a.m. 

Within minutes of the detonation, VNN reported an unidentified explosion in Landport and 
confirmed within the hour that it was a nuclear detonation. It did not report that the detonation 
was a terrorist attack until 2:35 p.m. 

At 12:15 p.m., the DHS Secretary publicly declared the Landport attack an Incident of National 
Significance. 

After much consideration, HHS decided to give administrative leave to all NCR employees at 
12:20 p.m. Options for both unscheduled and administrative leave were discussed. 

DHS issued a press release at 12:23 p.m. stating that an investigation of a credible threat to 
Landport was underway. By 12:30 p.m., 14 NDMS teams, four US&R teams, and an ERT-N had 
deployed to Philadelphia, PA, and additional teams were (notionally) on alert. FEMA Regions 
III, IV, and X also (notionally) activated. At this time, DHS also confirmed that the Landport 
blast was nuclear. 

At 12:30 and 12:45 p.m., DHS hosted an SVTC, during which participants decided to raise the 
HSAS level in Landport to red. At 1235 HHS operations called DoD about patient movement. 
The DoD Secretary declared DEFCON 2 at 12:53 p.m. 

Back in the NCR, the HSAS level remained at red, and FBI render safe activities were ongoing. 
At 12:33 p.m., the DC mayor declared a public emergency in response to the threat. There was 
speculation that an evacuation of DC was imminent. 

At 1:15 p.m., ESF #8 reported that FMS and RDF teams had been activated and staged 
(notionally) and that FEMA had (notionally) deployed essential commodities to the affected 
area. In the meantime, the president issued a statement on the Landport attack. 

At 1:17 p.m., DOE completed initial NARAC/IMAAC plots for Landport in response to a 
request for the models at 12: 18 p.m. Despite inquiries to the HSOC, HHS did not receive the 
plume model; by 1:50 p.m., its own subject matter experts (SME) had drawn graphs to estimate 
casualties and how long responders can safety stay in the hot zone. After additional inquiries to 
DHS, HHS finally received the plume models at 2:05 p.m. Similarly, the Landport SIMCELL 
did not receive the plume models either. After inquiring of the IMAAC, it received them about 
five hours after the detonation. 

By 2:10 p.m., several ERTs and one FIRST were (notionally) on their way to Landport and 
Region X, while NDMS, Disaster Mortuary Operations Response Teams (DMORT), and US&R 
teams were (notionally) mobilized. In addition FEMA began coordinating response activities 
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with the American Red Cross. At 2:20 p.m., DHS issued a press release on Landport response 
activities as well as a statement from the DHS Secretary. Twenty minutes later, the HHS 
Secretary declared a public health emergency. SNS pushpacks and TARU teams were identified 
for deployment to Landport, 

DHS distributed the Incident of National Significance statement at 2:44 p.m. By 3:00 p.m., it 
released estimates that approximately three to three and a half square miles were completely or 
mostly destroyed in the Landport attack. There were no casualty estimates at this time. 

At 3: 10 p.m., the FBI completed render safe activities in the NCR and began preparing the 
device for shipment by 5:55 p.m. By this time 15 to 20 percent of Prince George’s County had 
been evacuated. 

During a 3:30 p.m. NICCL conference call, the JICC learned that that radioactivity in Landport 
was moving southeast and that first responders were (notionally) having difficulty getting to the 
area. The CDC reported that it had contacted public health directors and other health officials 
and that the SNS was ready for deployment. 

By 3:38 p.m., USTRANSCOM had implemented its patient movement capability to support 
NDMS and other pending missions. Shortly thereafter, the DoD Secretary ordered a surging of 
DoD asserts in the northwest region to accommodate mass casualties. 

At 3:55 p.m., Landport informed HHS that it needed ten Disaster Medical Assistance Teams 
(DMAT) and five DMORT, and recommended using Landport airport as a staging area. Its 
hospital system had been locked down to avoid further contamination. In the meantime there was 
ongoing discussion at DHS on the status of render safe operations, whether the HSAS level in 
the NCR should be lowered to Orange, and whether evacuation from the NCR should cease. 

According to a 4:30 p.m. VNN report, the Landport detonation resulted in 1,000 confirmed 
fatalities, 15,000-30,000 estimated fatalities, and 30,000-100,000 recipients of fatal doses of 
radiation. At 4:54 p.m,, HHS issued press releases on its ongoing Landport response activities 
and safety and decontamination recommendations, and DHS issued a press release naming 
principal Federal officials. HHS issued another press release an hour later on the public health 
emergency declaration for Central Pacifica. 

At 5:04 p.m., the JTF-NCR issued a press release on the Andrews Air Force Base evacuation that 
took place earlier that day. The FBI moved the device out of the NCR at 6:19 p.m. 

At 6:57 p.m., the president issued a major disaster declaration for Central Pacifica. 

FEMA issued a press release at 9:21 p.m. on the disaster declaration, and another at 9:30 p.m. on 
response activities in Landport. 

At 9:30 p.m., the HSAS level was reduced to Orange in the NCR and the Prince George's County 
evacuation order was rescinded. DHS reported 1,000 known fatalities, 15,000-30,000 estimated 
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fatalities, and 30,000-100,000 estimated recipients of fatal doses of radiation in the Landport 
detonation. 

3.4 June 22, 2006 

DHS issued a press release at 6:35 a.m, stating that the HSAS level had been lowered to Orange 
in the NCR. At 9:45 a.m., it hosted a SVTC to discuss courses of action for sheltering in place, 
mass decontamination, mass care, and response assets in Landport. 

At 10:30 a.m., the DHS Secretary gave an update on ongoing response activities, followed by a 
statement to DHS employees at 1 1:08 a.m. 

The T4 CPX concluded at 12:00 p.m. 
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40 ANALYSIS OF MISSION OUTCOMES AND CRITICAL TASK PERFORMANCE 

This section analyzes exercise play and the key issues that arose in the three focus areas of 
analysis selected in the Evaluation Plan. Table 3 shows those focus areas and their key 
discussion issues. 


Table 3. Focus Areas of Analysis 


Focus Area 

Issues 

WMD response 

* Some predetonation decisions/actions may have 
compromised operational security, 

• Protective actions/recommendations were not 
coordinated with State and local governments. 

* The May 25 NRP notice of change was not fully 
implemented, 

• The deployment of Federal and volunteer personnel was 
limited by WMD contamination. 

Situational awareness and 
information sharing 

* Federal D/As and the NCR did not share situational 

awareness. 

• Intelligence was not consistently shared across Federal 
D/As and the NCR. 

Public infonnation 

• Conflicting guidance was provided to Federal 

government employees and the public before the WMD 
blast. 


41 WMD Response 

Homeland Security Presidential Directive 5 (HSPD-5) designates that the Secretary of Homeland 
Security is responsible for coordinating Federal resources within the United States to prepare for, 
respond to, and recover from terrorist attacks, major disasters, and other emergencies. The NRP 
and NIMS are the overarching doctrine for carrying out this responsibility. In this section, we 
discuss several issues that arose in the coordination of the response to the T4 CPX WMD 
scenario. 

4.1.1. Some predetonation decisions/actions may have compromised operational security. 

The NRP contains the following information regarding operational security: 

• Operational security considerations may dictate that activation of NRP elements be kept 
to a minimum, particularly in the context of certain terrorism prevention activities, 

• In the preincident mode, notification of an Incident of National Significance may be 
conducted discreetly, on a need-to-know basis, so as to preserve the operational security 
and confidentiality of certain law enforcement and investigative operations. 

• The NRCC begins interagency operations by coordinating initial activation, the 
deployment of special teams, etc., as dictated by operational security considerations. 

• PFO designations may be made on a discreet need-to-know basis to preserve operational 
security. 
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The HSOC, NRCC, and IIMG SOPs* provide no additional details on operational security 
considerations other than what is already described in the NRP. 

Summary of Issue 

During the T4 CPX, several predetonation decisions and actions could have compromised 
operational security: notably implementing COGCON Level 1, raising the HSAS level, and 
implementing the Catastrophic Incident Annex (CIA) of the NRP. 

Consequence 

It is assumed by Federal law enforcement and intelligence personnel that terrorists would alter 
their plans if they knew they were compromised. Alterations could include advancing their 
timetable for detonation, altering their plan to strike at secondary targets, destroying evidence of 
their activities, Feeing in an attempt to escape without completing their mission, and discarding 
or hiding the device for later retrieval. 

Analysis 

Some of the decisions and actions taken in the T4 CPX contrasted with those made during a 
previous tabletop exercise with a similar scenario. Vulcan Warrior, the fourth in a series of 
Homeland Security tabletop exercises for senior officials in FY-05, addressed policy and 
operational issues that could arise if the president ordered the Federal government to implement 
a COGCON for COOP Level 1 plan in response to the threat of an imminent improvised nuclear 
device (IND) attack. The discussion centered around what information would be shared, and 
with whom. Many of the same decisions and actions that occurred during Vulcan Warrior were 
also considered during the T4 CPX. Therefore, we compare some of these decisions with the 
discussions recorded during Vulcan Warrior. 

COGCON Level I 

As in Vulcan Warrior, the elevation to COGCON Level 1 was prescripted for the purposes of the 
T4 CPX. However, participants in Vulcan Warrior did not support the scripted COGCON for 
COOP Level 1 decision, given the scenario course of discussion. Participants felt it would be 
impossible to inform all Federal agencies that they would need to prepare for imminent 
relocation of their leadership to their Level 1 alternate facilities without risking an immediate 
compromise of operational security. They felt that such a decision would almost certainly be 
detected by the terrorists and could trigger early detonation of the IND. In addition, they 
predicted that such a decision would almost surely trigger a massive, spontaneous evacuation 
from the Washington, DC, metropolitan area, resulting in massive gridlock and putting more 
people at risk for the effects of the IND, if detonated. 

HSAS Elevations 

A consensus emerged among participants in Vulcan Warrior that the intelligence and 
information related to a potentially imminent, but non-geographically specific, WMD threat 
would be tightly controlled and shared only among those with a need to know. Based on this 
insight/decision, officials determined that there would be no benefit to changing the HSAS. 
Participants in Vulcan Warrior did not discuss changes to the HSAS level once they had 


® The HSOC and IIMG SOPs have not yet been updated to reflect the transition to the NOC and lAC. 
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geographic specificity of the threat. However, they did acknowledge that operational security 
would still be the prime concern with this additional information. 

The T4 CPX threw a twist into the Vulcan Warrior .scenario with two WMD threats, one known 
to be in the NCR and a second, less specific threat to several geographic areas. Several decisions 
were made in response to the known threat to the NCR, namely changing to COGCON Level 1 
and raising the HSAS level. It is possible that these decisions could have compromised 
operational security for the operations against the second threat. In fact in the scenario the 
Landport terrorist Husseini detonated the second WMD early because he was concerned about 
the continuous news reports and felt threatened by the CBP officers who boarded and searched 
his yacht. 

Declaring an INS and Implemen ting the CIA 

Just after the SVTC on the morning of June 21, many D/As were told an INS was in effect and 
that the CIA had been activated. Although some of the initial reports that the Secretary had 
declared an Incident of National Significance used the terms “secret” or “classified,” this 
information was fairly well known prior to the blast and there was no direction on how this 
information should be treated.^ Thus, operational security was not widely considered when 
taking actions prior to the blast that could have been noticed by the public or the terrorists. For 
example, FEMA began preparing to prestage personnel and supplies in both the NCR and 
Landport according to the CIA. Such actions were not discussed in Vulcan Warrior. 

Recommendation 

Because the move to COGCON Level 1 was prescripted, the exercise provided only a limited 
opportunity to examine alternatives to this action. DHS should collaborate with the intelligence 
community and State and local governments to examine these decisions and actions and identify 
potential alternatives to COGCON Level 1 in this type of scenario. In addition, operational 
security issues should be addressed in NRP supporting policies and procedures. Suggested 
corrective actions are listed in Table 4. 

Table 4. Operational Security: Suggested Corrective Actions 


Corrective 

Action 

Description 

Responsible 

Agencies 

Timeline 

Develop 
alternatives to 
COGCON Level 

1 in the COOP 
architecture. 

Consider alternatives to COGCON Level 1, such 
as creating operational depth by ensuring that 
geographically dispersed individuals are trained to 
carry out COOP roles and responsibilities or using 
devolution in place of moving all essential 
personnel. 

DHS— 

FEMA 

12 

Month.s 

Create additional 
measures in 

COOP plans to 
minimize impact 
on local 

Additional measures should be added to COOP 
plans to account for a deployment’s impact on the 
local economy and infrastructure and for the 
logistical challenges associated with deployment. 
Memorandums of Understanding (MOUs) should 

DHS— 

FEMA 

6 Months 


^ It was not released to the public in an olTicial statement until 2:20 p.m. on June 21 . 
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Corrective 

Action 

Description 

Responsible 

Agencies 

Timeline 

comniLiiiities. 

be signed with the host communities. 



Develop an 
interagency 
playbook for the 
NRP. 

Develop an interagency playbook for the NRP, 

This would be a companion piece to the NRP that 
would be prescripted with operational security 
considerations, user checklists, have a common set 
of questions, and would also be developed for the 

15 National Planning Scenarios. 

DHS— 

Preparedness 

Directorate 

9 Months 

Write operational 
plans for 
catastrophic 
scenarios. 

Write specific operational plans that would 
complement the operational framework contained 
in the Catastrophic Incident Annex of the NRP and 
address operational security in specific scenarios. 

DHS— NOC 
Planning 
Element 

1 Year 


4.1.2. Protective actions/recommendations were not coordinated with State and local 
governments. 

Summary of Issue 

During the T4 CPX, several key protective actions/recommendalions made by DHS were not 
coordinated with the NCR, most notably increasing the COGCON level to 1 , raising the HS AS 
level to Red, and evacuating Prince George’s County, Maryland. 

Consequence 

The NCR was unable to participate in the development of protective actions and examine how 
they would be implemented in coordination with the Federal government. It is likely that the lack 
of participating senior leadership, different levels of commitment among FSL D/As to the CPX, 
and misunderstandings about exercise design all contributed to the artificial decision-making 
process. 

Analysis 

During the 8:30 a.m. SVTC on June 21, participants decided to raise the HSAS level to Red for 
the NCR and to evacuate Prince George’s County. The previous day, a SVTC was held to 
discuss intelligence and changes in COGCON levels. No officials from the NCR were consulted 
about these decisions.'*^ On many occasions during the exercise, NCR officials requested 
information through the Office of National Capital Region Coordination (ONCRC), which was 
repeatedly unable to obtain information from the NOC for release. For example, NCR players 
were notified that the COGON Level was raised to Level 2 at about 8:00 p.m. on June 20, by the 
ONCRC. Officials from DC immediately responded by asking why and whether a change in 
HSAS level was being considered. The ONCRC forwarded this request to the NOC but received 
no information to pass on to the NCR participants. 


The COGCON level changes were prescripted for the CPX. 
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It is possible some information was withheld from NCR officials for operational security 
concerns. If so, this is counter to the criteria established during Vulcan Warrior, in which 
participants said that operational security is more important than sharing information only when 
the geographic location of the WMD threat is unknown. At that time in the T4 CPX, one WMD 
threat was known to be in the NCR. Because information about that threat was not shared with 
NCR officials, they were not involved in decision making regarding protective action 
recommendations. As discussed later in the Public Information section, the Federal government 
took protective actions in the NCR in response to the threat. 

There was little discussion recorded about the implications of decisions made in the 8:30 a.m. 
SVTC. For example, with the HSAS level being raised to Red in the NCR and Orange for the 
nation, what were the particular actions that FSL D/As were supposed to implement in response 
to this elevation? What did this mean for jurisdictions near but outside of the NCR? Although not 
widely recorded during this exercise, this issue has received considerable discussion during past 
TOPOFF exercises and it is unclear whether it has been clarified. Also not discussed was what 
the public should be doing in response to the HSAS elevation. The information given in the 
11:11 a.m. press release on June 21 was to follow the guidance of State and local officials and 
review family preparedness plans. Because this decision and press release were not coordinated 
with State and local officials, they did not have the opportunity to develop recommendations. 

Many players thought that the DHS Secretary had ordered the evacuation of Prince George’s 
County.' ' The Federal authority to order an evacuation is defined in the NRP. The NRP assumes 
that evacuation plans are initiated on the State and local level and that Federal officials will work 
in conjunction with State authorities when executing the plan. Federal assistance is provided 
when the emergency or disaster overwhelms the State or local entity, and once involved. Federal 
officials take the lead on coordination and technical assistance. For example, the Department of 
Transportation (DOT) would aid in coordinating critical facility closures and movement 
restrictions to allow for traffic flow during an evacuation. 

Clearly, the evacuation of Prince George’s County was an action that would have required a 
tremendous amount of coordination with State and local officials in the NCR. Questions that 
would need consideration include the following: 

• Where were county citizens supposed to evacuate considering the HSAS level was Red 
for the entire NCR and that traffic congestion that was being reported? 

• Where were shelters to be set up and who was to operate them? How were people to get 
there? 

• How were those with special needs being assisted? 

When the ESF#1 (transportation) Liaison in the NRCC heard that Prince George’s County was 
being evacuated at about 10:30 a.m. on June 21, he inquired whether there was a need for 


*' It is likely that the outcome from the SVTC was the recommendation to evacuate Prince George’s County. The 
Evaluation Team was not privy to the SVTC, nor were any notes released from the SVTC. Regardless of what was 
stated in the SVTC, the D/As proceeded as if the evacuation had been ordered. 
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Federal assistance. The NRCC followed up on this and was told that no Federal assistance was 
required and the evacuation was being handled locally. 

Recommendations 

The coordination of protective actions in collaboration with state and local governments was not 
fully exercised in the T4 CPX. The Federal government should include State and local NCR 
governments in future COOP and HSAS-related preparedness activities to improve coordination 
of protective actions during a crisis. Suggested corrective actions are listed in Table 5. 

Table 5. Coordinating Protective Actions: Suggested Corrective Actions 


Corrective 

Action 

Description 

Responsible 

Agencies 

Timeline 

Collaborate with 
the NCR to 
address 

protective action 
coordination. 

Conduct exercises, workshops, and/or plan reviews 
in coordination with the NCR to ensure that 

Federal government plans for evacuation and other 
protective actions are fully synchronized with NCR 
plans. 

DHS— 

Preparedness 

6 Months 

i 


4.13. The May 25 NRP notice of change was not fully implemented. 

A few weeks before the exercise on May 25, 2006, DHS issued a notice of change detailing 
several revisions to the NRP. One change established the NOC as the successor to the HSOC, 
and reformulated the former IIMG as a senior advisory council and adjudication body for the 
Secretary of Homeland Security in his role as the Federal incident manager. 

Summary of Issue 

The NOC, lAC, and the NOC planning element are new entities replacing the HSOC and IIMG. 
The supporting policies and procedures for these entities have not yet been developed. Because 
the membership for the lAC has not been established, members of the IIMG played as the lAC 
Transition Team. The NOC participated fully, but has not increased in size beyond the HSOC. 
The NOC planning element was not yet established. Furthermore, the NRP is a high-level policy 
document and many of the supporting plans and procedures that are necessary to carry out the 
roles and responsibilities it describes are still under development. 

Consequences 

Personnel had little information about what the new roles of the NOC and lAC were and how 
they should be interacting within the larger response structure. 

Analysis 

The definition of the I AC as recorded in the May 25 notice of change is as follows: 

“The lAC is a tailored group of senior Federal interagency representatives that 
adjudicates matters that cannot be resolved by the NOC-NRCC and provides strategic 
advice to the Secretary of Homeland Security during an actual or potential incident 
requiring Federal coordination.” 
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Pi'eviously, the IIMG was described as a “Federal headquarters-level multiagency coordination 
entity that facilitates strategic Federal domestic incident management for Incidents of National 
Significance.” During the exercise, the I AC Transition Team prepared courses of action (COAs) 
briefings for the Secretary and developed planning priorities. This role was similar to what the 
IIMG had done in past exercises and emergencies. 

The COA groups within the lAC included domestic counterterrorism and law enforcement; 
border, maritime, and transportation security; critical infrastructure protection; public health and 
medical; emergency response and recovery; WMD detection and preparedness, and incident 
communications. On June 21 and 22, these groups met to develop courses of action and 
recommendations for the Secretary. However, the lAC Transition Team was not well integrated 
into the larger Federal response structure. As a result, it had difficulty receiving information and 
fulfilling a strategic role during the exercise. 

At 9:00 a.m. on June 21 , the lAC Transition Team was reported to be in a holding pattern 
because it had received no direct taskings. By 9:22 a.m., it developed its own planning priorities, 
which included NCR consequence management, incident communications, HSAS status, 
radiological detection, and mass evacuations. 

At about 10:00 a.m., following the SVTC, the lAC was tasked to provide recommendations on 
resource allocation. Members discussed whether this was an appropriate tasking. They thought 
their role was to adjudicate resource decisions for the ESFs. However, they did not know if the 
NRCC was stood up at that time with all the ESFs. In fact, the NRCC was operational and was 
already addressing resource allocation. 

By 2:02 p.m., the lAC Transition Team was focusing on what resources and capabilities that 
each lAC Transition Team member agency could bring to the table in preparation for the next 
SVTC. The lAC Transition Team representatives responded by developing lists of teams, assets, 
and capabilities. As discussed, the NRCC had already begun tracking and deploying assets. For 
example, it had already notionally activated NDMS and USAR teams and begun preparing to 
prestage essential commodities as described in the CIA. 

Several times during the day, the lAC Transition Team participants noted problems receiving 
information because they were not participating in the SVTC with the Secretary and DHS 
leadership. Thus, they received information secondhand and much later than they expected. The 
ONCRC representative reported receiving more intelligence through NCR personnel working in 
the field than was received from the NOC. As discussed in the next section on infonnation 
sharing, many participants experienced this problem. The lAC Transition Team also reported 
problems sharing information with their D/As because they were in a secure location where 
information was treated as classified and could only be shared through secure channels with 
cleared personnel. 

Recommendations 

Additional work is needed to ensure tlie recent updates to the NRP are transformed into an 
operational capability. This requires developing supporting policies and procedures and 
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educating the emergency response community about the role of these new structures and how 
they are implemented. Corrective actions are listed in Table 6. 

Table 6. NRP Changes: Suggested Corrective Actions 


Corrective 

Action 

Description 

Responsible 

Agencies 

Timeline 

Establish SOPs 
for the lAC and 
NOC. 

Establish SOPs for the lAC, the NOC planning 
element, and the NOC itself, making sure to 
integrate those plans with any changes to COOP 
plans and the functionality of the COP. 

DHS— 
Office of 
Operations 
Coordination 

3 Months 

Establish 
procedures for 
publicizing 
changes to the 
NRP. 

Develop and establish procedures, to include 
associated training and education, for publicizing 
and institutionalizing changes to the NRP so that 
Federal, State, and local (FSL) officials and 
responders are aware of changes to the response 
architecture. 

DHS— 
Preparedness 
Directorate 
& FEMA 

3 Months 

Develop a 
training and 
education 
program for the 
NRP. 

Develop a comprehensive, continuing training and 
education program for the NRP that is aimed at 

FSL levels — both for authorities and responders. 

DHS— 
Preparedness 
Directorate 
& EEMA 

6 Months 


4.1.4. The deployment of Federal and volunteer personnel was limited by WMD 
contamination. 

According to the nuclear/radiological incident annex of the NRP, the Advisory Team for 
Environment, Food, and Health is responsible for providing protective action recommendations, 
including; 

• health and safety advice or information for the public and for workers; and 

• recommendations for relocation, reentry, and other radiation protective measures prior to 
recovery. 

In this scenario, DHS and DOE, as the coordinating agency, would oversee this effort. Because 
the field activities in the Landport area were simulated, the Advisory Team was not fully 
exercised during the T4 CPX. 

Summary of Issue 

It was unclear who was responsible for determining what areas were considered safe when 
Federal D/As were making plans to deploy personnel and other resources into the affected area. 

Consequences 

A coordinated strategy for staging and deploying responders and ensuring they were not exposed 
to unsafe levels of radiological contamination was not evident during the exercise. The 
simulation of Federal field response teams likely contributed. 
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Analysis 

The IMAAC distributed hazard assessment reports that modeled predictions of health effects. 
These analyses were intended to inform protective action recommendations and support policy 
making. However, no entity appeared to step in and fill this policy role. Thus, D/As were left to 
independently interpret this information. 

For example, the American Red Cross (ARC) was concerned about the safety of volunteer 
personnel. ARC received several requests for assistance that included: 

• sheltering attendants and family members of patients to be evacuated to 15 hospitals in 
the Landport area under ESF#8; 

• distributing clothing to those going through decontamination sites; and 

• providing support to the cities/States sheltering evacuees from the Landport area. 

In the 2:00 a.m, NRCC SITREP on June 22, ARC noted that mass care assistance was limited to 
decontaminated individuals in areas outside of the impacted area. ARC participants also noted 
that life safety issues were the main operational concern of ARC Disaster Operations Center 
(DOC) activity leads. 

Similarly, FEMA raised concerns about the NDMS and USAR teams deployed to the Landport 
area, many of which were notionally deployed prior to the detonation. These personnel were 
being staged at two mobilization centers: Ft. Lewis in Tacoma, WA, and the National Guard 
Base in Salem, OR. Ft. Lewis is about 1 30 miles from the notional city of Landport and Salem is 
about 50 miles away. At a 3:00 p.m. meeting on June 21, FEMA personnel discussed the safety 
of their responders and the need to ensure that they were not exposed to unsafe levels of 
radiation. At about the same time, HHS discussed the staging of NDMS teams at the Landport 
airport. The Landport SIMCELL told HHS that the area was safe, but FEMA did not agree. At 
7:20 p.m. that evening, FEMA told HHS that it would not support missions close to blast site and 
directed all assets to Ft. Lewis for staging. 

Information sharing problems and exercise artificialities likely contributed to FEMA’s concerns 
regarding personnel safety. On a 10:30 a.m. conference call with the NOC on June 21, the NRCC 
asked the NOC to provide a briefing on the potential impacts of a nuclear device. However, it 
never received a response to its request. When the NRCC had scientific questions about the 
detonation and the radiological contamination, there was no one present to provide an answer. 
These questions would have been raised to the ESF#12 liaison from DOE. However, this 
position was not staffed for the exercise. 

Recommendations 

A single point of contact should be designated as the responsible entity for providing a strategy 
for the deployment and staging of personnel and supplies into a potentially contaminated 
environment. This will ensure consistent protective actions are employed across the response 
effort. Suggested corrective actions are listed in Table 7. 
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Table 7. Response Personnel Safety: Suggested Corrective Actions 


Corrective 

Action 

Description 

I^ead 

Agency 

Timeline 

Claiify the 
responsible 
entity for 
providing 
guidelines for 
deployment into 
potentially 
contaminated 

areas. 

Determine the responsible entity and roles of 
DHS/DOE and the Advisory Team for providing 
guidelines for deployment into potentially 
contaminated areas. 

DHS/DOE 

1 Month 


4.2 Information Sharing and Maintenance of a COP 

One objective of the T4 CPX was to test the ability of command/operations/intelligence centers 
to share intelligence and information and maintain a COP. These activities are important for 
maintaining a shared situational awareness among D/As and ensuring a coordinated multiagency 
response. The sharing of response and intelligence information is examined in this section. 

4.2.1. Federal D/As and the NCR did not share situational awareness. 

According to the NRP, the NOC is responsible for providing a general domestic situational 
awareness and a common operational picture. According to the HSOC (NOC) SOP, the NOC 
provides information to D/As through the following avenues: 

• Existing real-time communications links 
. HSIN 

• Distributing warnings and bulletins 

• DHS alerts (INS and HSAS level changes are listed as examples). 

Summary of the Issue 

Despite efforts to improve communications and information sharing across Federal D/As and 
with NCR organizations, they all lacked a shared situational awareness of key information during 
the T4 CPX. DHS is currently developing the COP, a component of HSIN, which provides a 
series of information screens that are designed to be displayed on a computer or projected on a 
display wall. The COP was not available at the time of the exercise. In addition, other methods of 
communicating key information did not appear to be used in place of the COP. 

Consequence 

Federal D/As and NCR organizations gathered information from many different sources, 
resulting in varied understandings about key information during the exercise. 

Analysis 

The Evaluation Team tracked the situational awareness of the following key pieces of 
information among Federal D/As: 
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• HSAS level changes 

• Declaration of an Incident of National Significance 

• Activation of the Catastrophic Incident Annex 

• Presidential Disaster Declaration (PDD) 

It is important to note that the first three were decisions made in SVTC meetings during the 
exercise. Many participants in these meetings noted that formal meeting control procedures, such 
as preparing and distributing an agenda, preparing meeting summaries, and tracking tas kings, 
were not used. Equipment problems also limited access for some participants, such as HHS, 
which did not have SVTC capability at its COOP site. The results of these meetings were not 
formally published and disseminated either. This resulted in participants coming out of the 
meetings with different understandings of what transpired and passing along different 
information to their D/As. 

HSAS Level Change 

In response to the intelligence injects, the Secretary of DHS decided to raise the HSAS level 
during an 8:30 a.m. SVTC that ended at approximately 9:40 a.m. Figure 3 compares the time to 
the first documented change in HSAS level across key Federal D/A operations centers. The 
figure labels show the source of the information at each location. The earliest notifications 
occurred at the NJIC and DoD SIMCELL. Both received phone calls from SVTC participants 
immediately following the meeting. The change was discussed or announced at most other 
locations about 45 minutes to an hour later. Some learned about it through senior leadership who 
had participated in the SVTC. Other D/As learned of the change through alternate sources, like 
the NICCL or VNN. In fact, the NJIC and NICCL calls became a good source of information for 
some D/As in the exercise because the NJIC conducted fact-checking exercises where it tracked 
and validated pieces of information. NCR participants were not notified of the HSAS level 
change, but later heard about it through the press release. 

All Federal D/As heard that the HSAS level was raised to Red in the NCR and Orange for the 
nation. As shown in Table 8, Federal D/As had inconsistent understandings of the HSAS level 
for Land port. The NRCC and DNDO were notified that the level was raised to Red for Landport 
following the SVTC, while most others assumed it to be Orange like the rest of the nation. Many 
of the D/As shown in the table were not notified of the Landport HSAS level being raised to Red 
or finally heard about it later that evening or the next day. Some D/As still did not assimilate the 
information even after Secretary Chert off reported it in a statement released at 2:20 p.m. on June 
21 . 


As discussed earlier under artificialities, senior level SVTC meetings were held in place of the HSC CSC 
meetings because the HSC did not participate. 
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Figure 3, Time of First Notification of an HSAS Level Change*^^ 

Decision made during the 8:30 a.m. SVTC, which ended at approximately 9:40 a an. 


Press Release issued [ 
DOD [ 

DHS/DNDO [ 

I 

USCG 

HNS 

DHS/NJIC 

DHS/NICC 

FEMA/NRCC 

DHS/NOC 


Discussion about 8:30 SVTC outcome 

I 


U Infrastructure Protection Brief 
I VNN 


NICCL Brief 


j Fact checking log 

I Discussion 
I Section Chief Brief 


Discussion about 8:30 SVTC outcome 


8:30 


8:58 


9:27 


9:56 10:25 10:54 11:22 


Table 8. Situational Awareness of the HSAS Level lor Landport''* 



INS and CIA 

Also at the 8:30 a.m, SVTC, the Secretaiy of DHS decided to declare an Incident of National 
Significance and activate the Catastrophic Incident Annex. As shown in Figure 4, some Federal 
D/As experienced delays in learning about these two decisions and some never learned of it at 
all. More D/As knew that an Incident of National Significance was declared than knew the 
Catastrophic Incident Annex had been implemented. This may be because the Incident of 
National Significance was included on HSOC’^ and FEMA spot reports, the earliest of which 
was recorded at 1 1:30 a,m. on June 2L 


See Appendix A for a list of acronyms. 

See Appendix A for a list of acronyms. Blank spaces indicate that it is unclear what the HSAS was thought to be 
at that time in that location because it was not recorded in the data. “No data” indicates a time when data were not 
avail able for that location. 

The title on the spot reports had not yet been changed to the NOC. 
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Fij>ure 4, Time of First Notification of an Incident of National Significance and 

Catastrophic Incident Annex'*' 

Decision made during the 8:30 a.m. SVTC, which ended at approximately 9:40 a.m. 


Press Release issued 
DOD 
HHS 
DHS/NJIC 
DHS/NICC 
FEIWNRCC 
DHS/NOC 


3 NICCL Brief 


Discussion about 12:30 
SVTC outcome 


Section Chief Brief 


Fact checking log 


□ INS ■ CtA 


Discussion about8:30 SVTC outcome 


8:30 9:42 10:54 12:06 13:18 14:30 15:42 


PDD 

As shown in Figure 5, several Federal D/As did not hear about the PDD even though it was 
documented in NRCC Spot Report 16. This indicates that either the spot report was not 
disseminated widely or it was not read and assimilated by all of the receiving D/As. There was a 
significant time lag between the simulated request by the governor and the PDD. During this 
time, we recorded numerous conversations where personnel were wondering if the president had 
declai'ed it a disaster. The delay is likely due to exercise control staff, as the final decision by the 
White House had to be simulated. 


Figure 5. Time of First Notification of PDD Request and PDD'^ 

PPD requested at 12:20 and approved at 17:00 


Press Release issued 
DOD 
USCG 
HHS 
DHS/NJIC 
DHS/NICC 
FEMA/NRCC 
DHS/NOC 


■ PDD Afpro\«d 
□ PDD Request 
Received from DHS 

Received from DHS 


] Fact checking log 


i I Nice Sport Report 


SITREP 


Info released in 
Spot Report 16 


I ] Info released in HSOC Sport Report 6 


12:20 13:40 15:00 16:19 17:39 18:59 20:19 21:39 22:59 


See Appendix A for an acronyrn list. 
'■ See Appendix A for an acronym list. 
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Recommendations 

The COP has the potential to improve information sharing and situational awareness across FSL 
D/As. DHS should ensure that D/As are able to access and use the system, that there are 
redundant methods for sharing information, and that D/As are able to assimilate this information 
into a shared situational awareness. Suggested con'ective actions are listed in Table 9. 

Table 9. Situational Awareness: Suggested Corrective Actions 


Corrective 

Action 

Description 

Responsible 

Agencies 

Timeline 

Finish 

development and 
deployment of 
the COP. 

Finish development and deployment of the COP 
system for use in the NOC. 

DHS— 
Office of 
Operations 
Coordination 

Ongoing 

Develop 
parameters and 
standards for the 
COP, to include 
Spot Reports and 
SITREPS. 

Develop parameters and standards so that D/As 
have established guidelines for accessing and 
contributing to the COP; development of these 
standards should be integrated with work on D/A- 
specific policies and procedures for HSIN. 

DHS— NOC 
& 

Interagency 

Ongoing 

Establish Video 
Teleconference 
protocols for 
Incidents of 
National 
Significance. 

Establish protocols for the use of SVTC during 
Incidents of National Significance to ensure that 
the necessary officials are included in the 
conferences and agendas, and to ensure that 
summaries of conclusions are distributed to all 
attendees- 

DHS— 
Executive 
Secretary & 
Office of 
Operations 
Coordination 

3 Months 

Develop D/A- 
specific policies 
and procedures 
for HSIN, 

Individual D/As should develop their own policies 
and procedures for the use of HSIN during a crisis 
and use those procedures during subsequent 
exercises. 

DHS— NOC 
& 

Interagency 

1 Year 

Conduct a 
feasibility study 
of integrating 
HSIN with web- 
EOC. 

Conduct a study of the integration of the two 
information-sharing systems — HSIN and web- 
EOC — so that FSL governments have access to the 
same information- 

DHS— 

Preparedness 

Directorate 

&SLGC 

1 Year 


4.2.2. Intelligence was not consistently shared across Federal D/As and the NCR. 

Summary of the Issue 

There were differences in the intelligence information available at Federal D/As and within the 
NCR during the exercise. Whereas some received detailed information about the threat in the 
NCR and Landport, others received little or no information. The location of personnel in secure 
and nonsecure sites contributed to these problems because classified information can only be 
transferred through secure phones or computer systems. Even when personnel in nonsecure sites 
had clearance to receive the information, they often did not have access to secure phones or 
computer systems. 
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Consequence 

The ability of some Federal D/As and the NCR to take protective actions and prepare to respond 
to a nuclear/radioiogical incident was impacted by the lack of information. 

Analysis 

Figure 6 shows exceipts of discussions and communications recorded at several locations during 
the exercise. The NOC was a secure site and personnel working there knew they had relocated 
because of a nuclear threat to the NCR. The other Federal sites were not equipped to handle 
classified information and personnel working there were not immediately aware of the nature of 
the threat and why they had relocated. By midmorning, however, all had heard that they were 
dealing with a nuclear/radiological threat. This infoianation came from many different sources 
and was not fomially disseminated. Some of it could be the result of leaks in the exercise 
scenario. 


Figure 6. Information Known about the Threat 


NCR 


% 

NOC: Nuclear 
device discussion 
(6:27 iAC 
Discussion) 

Federal 

Agencies 


NCR: FBI has detected 
a nuclear device in the 
NCR (Local LE notitied) 
(belore 8:00) 


T I I I I I I f 

^ : 

NJIC; F8I investigating a nuclear 

threat (8:55 Staff Briefing) 

NOC: Two WMDs in US„ 

(8:58 IAC Discussion) 


T 

9 


NJIC: Potential threat to city of 
Landport (9:54 Phone call) 


NCR: FBI has located a 
nuclear device at Andrews 
AFB (10:42 RlCCS alert) 


1 1 r— 

, I 10 

Y 

NOC: Second 
device in 
Landport 
unconfirmed 



HHS: Landport 
under snow 
day (10:56 
NICCL Call) 


(10:05 IAC 
^ discussion) , , 

I NRCC: Nuclear device 


HHS: Suspicious package 
caused evacuation of Prince 
George's County; potential 
radiological event (9:54 PIO) 


found in Prince George's 
County; possibility of one 
in Landport (10:26 Staff 
Briefing) 


The FBI told NCR law enforcement officials very early on June 21 that a nuclear device had 
been located in the NCR. They passed this information to their senior officials, who attempted to 
gel official notification from the NOC through the ONCRC and G&T, According to existing 
procedures for intelligence dissemination, the intelligence community members disseminate their 
information to the NOC. The NOC is then responsible for packaging the infoiTnation at the 
various classification levels necessary for use by Slale/local customers, as well as other Federal 
agencies. Although a request for infomiation was made to the NOC, it is unclear why no 
information was released to the NCR.^^ 


Memorandum from Russell Schweikharcl, Central Inielligence Agency, July 13, 2006. 

Our evaluation pkm did not include the collection of data on classified processes and procedures. 
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Many participants said that the lack of intelligence hindered their ability to take protective 
measures and to respond appropriately. For example, HHS personnel had no information on the 
threat at the time their COOP site was activated and only learned through their PIO that there 
was a potential radiological event. In an 1 1 :00 a.m. conference call with the DHS chief medical 
officer, HHS said that it was not informed of any intelligence information and was now 14 hours 
behind curve in terms of preparing to respond. NCR officials raised similar concerns and noted 
that the lack of intelligence limited their planning activities and ability to take protective 
measures. As discussed earlier, operational security concerns are one reason that intelligence 
sharing might be limited. The protection of sources is another. 

Also contributing to information sharing problems was that personnel were located in a variety 
of secure and nonsecure sites. For example, personnel with the lAC operated from a secure site 
where all the information they received was treated as classified. Thus, they could only pass 
information to their D/As through secure channels such as secure telephones or computer 
systems. Personnel receiving this information also needed proper clearance. However, even 
when personnel with the clearances were available, they often did not have the equipment 
necessary to receive classified information. 

Many participants noted that much of the information available in secure sites or on secure 
systems was unclassified, but personnel could not easily have this information downgraded to 
pass on. For example, the NICC said that information that was unclassified or classified at a low 
level was carried on systems with higher classifications that required arduous processes to move 
the information to systems where information sharing and visibility would be higher. It was 
unclear even with unclassified products whether they were cleared or not for release to the 
general public or private sector critical infrastructure and key resource partners (i.e., trusted 
industry community). 

Related to this issue, the NICC received numerous requests for information from the private 
sector. Because much of the information it was receiving came over classified systems, it could 
not easily downgrade this information for dissemination to private sector organizations. The 
Nice does not typically coordinate with the NJIC, so it did not have ready access to fact sheets 
and talking points to distribute to its private sector partners.^*^ It is important to note that the NJIC 
typically coordinates with the DHS Private Sector Office, which then provides information such 
as fact sheets and talking points to the private sector. However, during the CPX, the DHS Private 
Sector Office did not participate at the NJIC, which may have exacerbated this problem. 

Recommendations 

Coordinate with the intelligence community to further assess and address intelligence sharing. 
Improve coordination between the NICC and NJIC during emergencies to ensure information is 
disseminated to private sector organizations. Suggested corrective actions are listed in Table 10. 


The NICC and the NJIC have identified this as a potential problem and are identifying .solutions. 
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Table 10. Intelligence Sharing: Suggested Corrective Actions 


Corrective 

Action 

Description 

Responsible 

Agencies 

Timeline 

Review 

intelligence 

sharing 

procedures. 

Review intelligence sharing procedures and the 
role of the NOC to ensure that potential blockages 
in information flow are addressed. 

DHS— NOC 
OT&A 

6 Months 

Develop 
reachback 
alternatives for 
senior 
(eadership. 

Investigate alternative approaches to providing 
leadership officials in COOP facilities access to 
reachback and additional support capabilities and 
resources. 

DHS— 
Preparedness 
Directorate 
& NOC 

3 Months 

Ensure that 

COOP facilities 
have SCTFs and 
can shaie 
information at 
the same level of 
classification. 

For information-sharing purposes, ensure that 

COOP facilities, that have mission essential tasks 
that require TS/SCl information, have SCIFs with 
SIPRNET and DSN access. 

DHS— 

Preparedness 

Directorate 

&NOC 

12 

Month.s 

Develop a 
process for 
linking the NlCC 
with public 
messaging 
during an 
emergency. 

Develop protocols that describe NJIC and NICC 
communication and coordination in public 
messaging to ensure necessary information reaches 
the private sector. 

DHS— 
Preparedness 
Directorate, 
AS Public 
Affairs & 
NOC 

6 Months 


4.3 Public Information 

The term “emergency public information” reflects an understanding that public information 
during an emergency might differ from normal, day-to-day, public information provided to 
citizens by the government. In the event of a major disaster or emergency, this often means the 
coordination, development, and delivery of time-critical, lifesaving information to all potentially 
affected people. For this reason, public officials and government spokespersons often find that 
this aspect of their jobs is different in an emergency environment, and more important. In a 
climate of heightened uncertainty and concern, the timing and content of official statements can 
save lives, the media and general public are likely to scrutinize statements more, and some 
statements could incur heightened political liabilities. 

During the T4 CPX, the NRP was employed and ESF #15 was activated. Federal D/As set up a 
NJIC and activated the NICCL for communication and coordination of public information. Table 
1 1 shows the D/As that staffed the NJIC and those that issued press releases. In parentheses are 
the total numbers of press releases issued during the CPX. It is important to note that there was 
limited participation from the NCR and no real or simulated participation from State and local 
public affairs communities representing Landport or Central Pacifica. 
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CPX media play consisted of VNN broadcasts, the VNN.com website, and a media SIMCELL. 
As they have done in past TOPOFF exercises, VNN maintained an exercise website with articles 
and video clips about the exercise world. It also posted Federal D/As press releases on the 
website. The media SIMCELL represented a news wire service. The media SIMCELL made 
phone calls to Federal D/As, including the NJIC, and conducted mock interviews. They logged 
those calls and responses to their questions, and provided an hourly update to the MCC. 
Especially newsworthy information was provided as learned to VNN through the VNN 
controller, but the SIMCELL operated independently from VNN. 


Table 11. D/A Public Affairs Participation during the T4 CPX 


D/A 

Represented at the NJIC 

Is.sued Press Release 

DHS 

X 

X(ll) 

HHS 

X 

X(2) 

FEMA 

X 

X (2) 

USDA 

X 


OPM 

X 


DOJ 

X 

X(l) 

FBI 

X 

X(l) 

BLM 


X(3) 

DOE 


X(l) 

FCC 


X{4) 

DOD (JTF-NCR) 


X(2) 

NRC 


X(3) 

NTSB 


X(l) 

NCR 

X (participated in NICCL calls) 


Landport/CP 




4.3.1. Conflicting guidance provided to Federal government employees and the public 
before the WMD blast. 

Summary of Issue 

One of the most important requirements during emergencies is to provide the public with 
protective action guidance. During the T4 CPX, conflicting protective action guidance was 
provided to Federal government employees and the public in the NCR and in Landport before 
the WMD blast. However, that after the WMD blast in Landport, Federal D/As provided 
consistent information and guidance to the public. 

Consequence 

Given the conflicting information provided to the public and government employees in the NCR, 
the likely outcome would be additional confusion in the NCR and in Landport before the WMD 
blast and frustration with the Federal D/As. 

Although it is significant that Federal D/As were able to “speak with one voice” to the public 
after the WMD blast in Landport, it is important to recognize that in a real WMD emergency, the 
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public will look lo iheir State and local governments first for protective action guidance. 
Therefore, Federal D/A guidance must also be consistent with that provided by the State and 
local public affairs agencies. This has proved to be a significant challenge in previous TOPOFF 
exercises and was not examined during the T4 CPX. 

Analysis 

During the T4 CPX, conflicting protective action guidance was provided to Federal government 
employees and the public in the NCR and in Landport before the WMD blast. This is shown in 
Figure 7. 

The COGCON level was raised to 1 at 5:00 a.m, on June 21, OPM did not release nonessential 
government employees at this time. Instead, the decision was left to the individual D/As. This 
caused concern among officials at several D/As. For example, FEMA officials discussed what to 
do with their nonessential personnel but took no further action; DOT officials discussed whether 
this was a Federal or OPM decision, as there were no requests for Federal assistance. As far as 
the evaluation team could determine, the only D/A to take official action was HHS, which 
decided to grant administrative leave to their employees in the NCR at 12:20 p.m. Clear 
guidance or direction from OPM when the COGCON level was raised to 1 could have alleviated 
this concern. 


Figure 7, Protective Action Guidelines 


NCR 


DHS: COGCON 
level raised to 1 
(5:00) j 


DHS: Evacuation 
of Prince Georges 
County (9:45) ohS; HSAS 
raised to Red 
(9:45) 


OPM: Evacuate 
Federal workforce 
within 15 miles of 
Ciinton, MD 
(10:05) 


HHS:Adminrstrative 
leave granted to all 
non-essential NCR 
employees (12:20) 


i I i I i I I I I I I 


i I L I i I 


Landport 


DHS: Snow-day/ 
Sheiter-in-place (9:54) 


10 


12 


DHS: HSAS raised 
to Orange (9:45) 


OPM: Evacuate 
Federai workforce 
within 1 5 miies of 
Landport (11:03) 


At 9:45 a.m., the HSAS level was raised to Red in the NCR, and the Federal government 
recommended that Prince George’s County be evacuated. At 10:05 a.m., OPM directed the 
Federal workforce to evacuate only within a portion of the county — 1 5 miles around Clinton, 
MD. Notably, an evacuation area of this size includes several additional counties, including 
portions of Fairfax and Arlington Counties in Virginia, and portions of Washington, DC, 
including the White House (see Figure 8). In a real emergency, these inconsistencies would have 
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likely been observed and reported upon by the media, subsequently causing concern and 
confusion among the public. 

Shortly after the USAS level wa.s raised to orange at 9:45 a.m., the NJIC began working on a 
public statement for Landport residents to shelter-in-place. At 11:03 a.m., OPM directed all 
Federal employees within 15 miles of Landport to evacuate.^' The evaluation team has no data to 
show that the same recommendation was passed along to the public. This certainly is a cause for 
concern because, in a real emergency. Federal employees evacuating a city would not escape the 
notice of the media or the public. An emergency alert system (EAS) message was sent out after 
the blast. 



Although there is a balance between protecting operational security and providing information to 
the public, information passed to nonessential government personnel, at a minimum, must also 
be relayed to the public. In practical terms, the government workers are going to call their 
families, inevitably alerting the public that something unusual is occurring. 

The protective action guidance issued by the Federal D/As after the detonation in Landport was 
consistent. For example, in a press release just after the WMD blast, DHS referred directly to the 
CDC protective action recommendation. In addition, in a statement by the DHS Secretary at 
10:30 a.m. on June 22, he described assets that had deployed to Landport and activities 
undertaken and repeated the recommended protective action guidelines. The infonnation in this 
statement was consistent with press releases by each individual D/As made the day prior. 

Participants could have been acting on information leaked from the exercise scenario when making this decision. 
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Although it is significant that Federal D/As were able to maintain a consistent message to the 
public, in a real WMD emergency, the State and local protective action guidelines would also 
have to be consistent. This significant challenge was not addressed in the CPX, 

Recommendations 

Federal D/A guidance must be consistent with that provided by the State and local public affairs 
agencies. This has proved to a significant challenge in previous TOPOFF exercises and was not 
examined during the T4 CPX. This issue should be readdressed during the full-scale exercise. 
Suggested con'ective actions are listed in Table 12. 

Table 12. Public Information: Suggested Corrective Actions 


Corrective 

Action 

Description 

Responsible 

Agencies 

Timeline 

Analyze options 
for a dynamic 
public messaging 
system and 
integrate with 
TPAWS work. 

During a WMD event, different protective actions 
may need to be taken by the public, depending on 
where they are located. For instance, those in the 
fallout plume need to evacuate, while most others 
should shelter” in-place. Undertake an analysis of 
alternative means of delivering prescripted risk 
messages to different geographic segments of a 
population in order to communicate tailored 
recommendations for protective measures. This 
work should be integrated with the ongoing 

IPAWS initiative. 

DHS— 

FEMA& 

DOC— 

NOAA 

Ongoing 

Standardize 
leave policy for 
nonessential 
government 
personnel in an 
emergency. 

OPM should standardize emergency leave 
policy for nonessential government personnel 
with an elevation to COGCON Level 1 so that 
it is consistent among all D/As and is also 
consistent with expected guidance to the 
public. 

OPM 

3 Months 

Develop D/A- 
specific HSAS 
playbooks. 

Each D/A develop criteria/playbooks that outline 
what happens internally to their organizations 
when the HSAS threat level is raised. 

DHS & 
Interagency 

6 Months 
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5.0 CONCLUSIONS 

The evaluation of the exercise focused on three general areas: WMD response, situational 
awareness and information sharing, and public information. Within each of these areas, several 
key issues emerged and are addressed in this AAR. 

Focus Areas and Key Issues 

WMD response 

• Some predetonation decisions/actions may have compromised operational security. 

• Protective actions/recommendations were not coordinated with State and local governments. 

• The May 25 NRP notice of change was not fully implemented. 

• The deployment of Federal and volunteer personnel was limited by WMD contamination. 
Situational awareness and Information sharing 

• Federal D/As and the NCR did not share situational awareness. 

« Intelligence was not consistently shared across Federal D/As and the NCR. 

Public information 

• Conflicting guidance was provided to Federal government employees and the public before 
the WMD blast. 


Exercise artificialities and implementation issues affected the exercise and the key issues 
discussed in this report. Most notably, there was limited participation by the White House and 
HSC in the exercise itself, which affected decision-making and coordination. In addition, other 
artificialities limited Federal interagency and Federal-NCR coordination. 

Many of these issues were raised in past TOPOFF exercise and/or were noted during the 
response to Hurricane Katrina. Appendix B of this report includes a Corrective Action Plan 
focused on addressing these issues. 
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APPENDIX A: ACRONYM LIST 


ACRONYM 

DESCRIPTION 

AAR 

AFTER-ACTION REPORT 

ARC 

AMERICAN RED CROSS 

CBP 

CUSTOMS AND BORDER PATROL 

CDC 

CENTERS FOR DISEASE CONTROL 

CIA 

CATASTROPHIC INCIDENT ANNEX 

COA 

COURSE OE ACTION 

COGCON 

CONTINUITY OF GOVERNMENT CONDITION 

CONPLAN 

CONCEPT OF OPERATIONS PLAN 

COOP 

CONTINUITY OF OPERATIONS 

COP 

COMMON OPERATING PICTURE 

CP 

CENTRAL PACIFICA 

CPX 

COMMAND POST EXERCISE 

CSG 

COUNTERTERRORISM SUPPORT GROUP 

D/AS 

DEPARTMENTS AND AGENCIES 

DHS 

DEPARTMENT OE HOMELAND SECURITY 

DMAT 

DISASTER MEDICAL ASSISTANCE TEAM 

DMORT 

DISASTER MORTUARY OPERATIONS RESPONSE TEAM 

DNDO 

DOMESTIC NUCLEAR DETECTION OFFICE 

DOC 

DISASTER OPERATIONS CENTER 

DOD 

DEPARTMENT OF DEFENSE 

DOE 

DEPARTMENT OF ENERGY 

DOJ 

DEPARTMENT OF JUSTICE 

DOT 

DEPARTMENT OF TRANSPORTATION 

EOC 

EMERGENCY OPERATIONS CENTER 

ERT~N 

EMERGENCY RESPONSE TEAM- NATIONAL 

ESF 

EMERGENCY SUPPORT FUNCTION 

EXPLAN 

EXERCISE PLAN 

FBI 

FEDERAL BUREAU OF INVESTIGATION 

EC 06 

FORWARD CHALLENGE 2006 

FCC 

FEDERAL COMMUNICATIONS COMMISSION 

EEMA 

FEDERAL EMERGENCY MANAGEMENT AGENCY 

FIRST 

FEDERAL INCIDENT RESPONSE SUPPORT TEAM 

FSL 

FEDERAL, STATE, AND LOCAL 

HHS 

DEPARTMENT OF HEALTH AND HUMAN SERVICES 

HSAS 

HOMELAND SECURITY ADVISORY SYSTEM 

HSC 

HOMELAND SECURITY COUNCIL 

HSEEP 

HOMELAND SECURITY EXERCISE AND EVALUATION 

PROGRAM 

HSIN 

HOMELAND SECURITY INFORMATION SYSTEM 

HSOC 

HOMELAND SECURITY OPERATIONS CENTER 

HSPD-5 

HOMELAND SECURITY PRESIDENTIAL DIRECTIVE 5 

lAC 

INCIDENT ADVISORY COUNCIL 
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IIMG 

INTERAGENCY INCIDENT MANAGEMENT GROUP 

IMAAC 

INTERAGENCY MODELING AND ATMOSPHERIC ASSESSMENT 
CENTER 

IND 

IMPROVISED NUCLEAR DEVICE 

INS 

INCIDENT OF NATIONAL SIGNIFICANCE 

JTF 

JOINT TASK FORCE 

MC 06-02 

MARBLE CHALLENGE 2006-02 

MCC 

MASTER CONTROL CELL 

MSEL 

MASTER SCENARIO EVENTS LIST 

NARAC 

NATIONAL ATMOSPHERIC RELEASE ADVISORY CENTER 

NCR 

NATIONAL CAPITAL REGION 

NDMS 

NATIONAL DISASTER MEDICAL SYSTEM 

NIAC 

NATIONAL INFRASTRUCTURE ADVISORY COUNCIL 

Nice 

NATIONAL INFRASTRUCTURE COORDINATION CENTER 

NICCL 

NATIONAL INCIDENT COMMUNICATIONS CONFERENCE LINE 

NIMS 

NATIONAL INCIDENT MANAGEMENT SYSTEM 

NJIC 

NATIONAL JOINT INFORMATION CENTER 

NOC 

NATIONAL OPERATIONS CENTER 

NFS 

NATIONAL PLANNING SCENARIO 

NRC 

NUCLEAR REGULATORY COMMISSION 

NRCC 

NATIONAL RESPONSE COORDINATION CENTER 

NRP 

NATIONAL RESPONSE PLAN 

NTSB 

NATIONAL TRANSFORATION SAFETY BOARD 

ONCRC 

OFFICE OF NATIONAL CAPITAL REGION COORDINATION 

0PM 

OFFICE OF PERSONNEL MANAGEMENT 

OSLGC 

OFFICE OF STATE AND LOCAL GOVERNMENT COORDINATION 

PDD 

PRESIDENTIAL DISASTER DECLARATION 

PEO 

PRINCIPAL FEDERAL OFFICIAL 

PIO 

PUBLIC INFORMATION OFFICER 

RDF 

RAPID DEPLOYMENT FORCE 

SCIF 

SECURE COMPARTMENTALIZED INFORMATION FACILITY 

SIMCELL 

SIMULATION CELL 

SITREP 

SITUATION REPORT 

SNS 

STRATEGIC NATIONAL STOCKPILE 

SOE 

SENIOR OFFICIALS EXERCISES 

SOP 

STANDARD OPERATING PROCEDURE 

SVTC 

SECURE VIDEO CONFERENCE 

T3 

TOP OFFICIALS EXERCISE 3 

T4 

TOP OFFICIALS EXERCISE 4 

TARU 

TECHNICAL ASSISTANCE RESPONSE UNIT 

TOPOFF 

TOP OFFICIALS EXERCISE 

UA 

UNIVERSAL ADVERSARY 

US&R 

URBAN SEARCH AND RESCUE 

USAR 

URBAND SEARCH AND RESCUE 

USCG 

UNITED STATES COAST GUARD 
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USDA 

UNITED STATE DEPARTMENT OF AGRICULTURE 

USTRANSCOM 

UNITED STATES TRANSPORTATION COMMAND 

VNN 

VIRTUAL NEWS NETWORK 

WMD 

WEAPONS OF MASS DESTRUCTION 
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APPENDIX B: CORRECTIVE ACTION PLAN 

These actions were developed in coordination with a small group of interagency T4 CPX 
planners. They are intended to be further refined by DHS and the larger interagency into a 
corrective action plan. 


Corrective Action 

Description 

Responsible 

Agencies 

Timeline 

EXERCISE PARTICIPATION 

Conduct pre- 
exercise trtiining 
and education for 
senior leadership. 

Conduct training and education for senior 
leaders prior to the next FSE to ensure they are 
engaged and have full awareness of their 
anticipated role. 

DHS— 

Preparedness 

Directorate 

6 Months 

Write exercise 
CONPLANs for 
senior leadership. 

Write a concept of operations (CON PLAN) for 
the next FSE. Senior leadership would be the 
target audience, and the intent would be to 
provide them with a description of their roles 
and responsibilities during the exercise. 

DHS— 

Preparedness 

Directorate 

6 Months 

Expand exercise 
participant training. 

Expand the training and infoimation materials 
provided to players and field controllers to 
ensure they are aware of the expectations for 
coordination and interaction with participating 
and simulated organizations. 

DHS— 

Preparedness 

Directorate 

12 

Months 

OPERATIONAL SECURITY 

Develop alternatives 
to COGCON Level 1 
in the COOP 
architecture. 

Consider alternatives to COGCON level 1, 
such as creating operational depth by ensuring 
that geographically dispersed individuals are 
trained to carry out COOP roles and 
responsibilities or using devolution in place of 
moving all essential personnel. 

DHS— 

FEMA 

12 

Months 

Create additional 
measures in COOP 
plans to minimize 
impact on local 
communities. 

Additional measures should be added to COOP 
plans to account for a deployment's impact on 
the local economy and infrastructure and for 
the logistical challenges associated with 
deployment, MOUs should be signed with the 
host communities. 

DHS— 

FEMA 

6 Months 

Develop interagency 
pi ay book for NRP. 

Develop interagency playbook for the NRP, 

This would be a companion piece to the NRP 
that would be prescripted with operational 
security considerations, user checklists, have a 
common set of questions, and would also be 
developed for the 15 National Planning 
Scenarios, 

DHS— 

Preparedness 

Directorate 

9 Months 

Write operational 
plans for 
catastrophic 
scenarios. 

Write specific operational plans that would 
complement the operational framework 
contained in the Catastrophic Incident Annex 
of the NRP and address operational security in 
specific scenarios. 

DHS— NOC 
Planning 
Element 

1 Year 
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Corrective Action 

Description 

Responsible 

Agencies 

Timeline 

COORDINATING PROTECTIVE ACTIONS 

Collaborate with 
the NCR to address 
protective action 
coordination. 

Conduct exercises, workshops, and/or plan 
reviews in coordination with the NCR to ensure 
that Federal government plans for evacuation 
and other protective actions are fully 
synchronized with NCR plans. 

DHS— 

Preparedness 

6 Months 

NRP CHANGES 

Establish SOPs for 
thelAC and NOC, 

Establish SOPs for the lAC, the NOC Planning 
Element, and the NOC itself, making sure to 
integrate those plans with any changes to COOP 
plans and the functionality of the COP. 

DHS— 
Office of 
Operations 
Coordination 

3 Months 

Establish 
procedures for 
publicizing changes 
to the NRR 

Develop and establish procedures, to include 
associated training and education, for 
publicizing and institutionalizing changes to the 
NRP so that FSL officials and responders are 
aware of changes to the response architecture. 

DHS— 
Prepajedness 
Directorate 
& FEMA 

3 Months 

Develop a training 
and education 
program for the 

NRP. 

Develop a comprehensive, continuing training 
and education program for the NRP that is aimed 
at FSL levels — both for authorities and 
responders. 

DHS— 

Preparedness 

Directorate 

&FEMA 

6 Months 

PERSONNEL SAFETY 

Clarify the 
responsible entity 
for providing 
guidelines for 
deployment into 
potentially 
contaminated areas. 

Determine the responsible entity and roles of 
DHS/DOE and the Advisory Team for providing 
guidelines for deployment into potentially 
contaminated areas. 

DHS/DOE 

1 Month 

SITUATIONAL AWARENESS 

Finish development 
and deployment of 
the COP. 

Finish development and deployment of the COP 
system for use in the NOC. 

DHS— 
Office of 
Operations 
Coordination 

Ongoing 

Develop parameters 
and standards for 
the COP, to include 
spot reports and 
SITREPS. 

Develop parameters and standards so that D/As 
have established guidelines for accessing and 
contributing to the COP; development of these 
standards should be integrated with work on 
D/A-specific policies and procedures for HSIN. 

DHS— NOC 
& 

Interagency 

Ongoing 

Establish video 
teleconference 
protocols for 
Incidents of 

National 

Significance. 

Establish protocols for the use of SVTC during 
Incidents of National Significance to ensure that 
the necessary officials are included in the 
conferences and agendas, and to ensure that 
summaries of conclusions are distributed to all 
attendees. 

DHS— 
Executive 
Secretary & 
Office of 
Operations 
Coordination 

3 Month.s 
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Corrective Action 

Description 

Responsible 

Agencies 

Timeline 

Develop D/A- 
specific policies 
^nd procedures for 
HSIN. 

Individual D/As should develop their own 
policies and procedures for the use of HSIN 
during a crisis and use those procedures during 
subsequent exercises. 

DHS— NOC 
& 

Interagency 

1 Year 

Conduct a 
feasibility study of 
integrating HSTN 
with web-EOC. 

Conduct a study of the integration of the two 
information-sharing systems — HSIN and web- 
EOC — so that FSL governments have access t{> 
the same information. 

DHS— 

Preparedness 

Directorate 

&SLGC 

1 Year 

INTELLIGENCE SHARING 

Review intelligence 
sharing procedures. 

Review intelligence sharing procedures and the 
role of the NOC to ensure that potential 
blockages in information flow are addressed. 

DHS— NOC 

6 Months 

Develop reachback 
alternatives for 
senior leadership. 

Investigate alternative approaches to providing 
leadership officials in COOP facilities access to 
reachback and additional support capabilities 
and resources. 

DHS— 

Preparedness 

Directorate 

&NOC 

3 Months 

Ensure that all 

COOP facilities 
have SCIFs and can 
share information 
at the same level of 
classification. 

For information-sharing purposes, ensure that all 
COOP facilities have SCIFs with SIPRNET and 
DSN access. Also ensure that all COOP 
facilities are cleared for the same level of 
classification to meet operational requirements. 

DHS— 

Preparedness 

Directorate 

&NOC 

12 

Months 

Develop a process 
for linking the 

Nice with public 
messaging during 
an emergency. 

Develop protocols that describe NJIC and NICC 
communication and coordination in public 
messaging to ensure necessary information 
reaches the private sector. 

DHS— 
Preparedness 
Directorate 
& AS Public 
Affairs 

6 Months 

PUBLIC INEORMATION 

Analyze options for 
a dynamic public 
messaging system 
and integrate with 
IPAWS work. 

During a WMD event, different protective 
actions may need to be taken by the public, 
depending on where they are located. For 
instance, those in the fallout plume need to 
evacuate, while most others should shelter-in- 
place. Undertake an analysis of alternative 
means of delivering prescripted risk messages to 
different geographic segments of a population in 
order to communicate tailored recommendations 
for protective measures. This work should be 
integrated with the ongoing IPAWS initiative. 

DHS— 
FEMA & 
DOC— 
NOAA 

Ongoing 

Standardize leave 
policy for 
nonessential 
government 
personnel in an 
emergency. 

OPM should standardize emergency leave 
policy for nonessential government 
personnel with an elevation to COGCON 
Level 1 so that it is consistent among all 

D/As and is also consistent with expected 
guidance to the public. 

OPM 

3 Months 
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Corrective Action 

Description 

Responsible 

Agencies 

Timeline 

Develop D/A- 
specific HSAS 
play books. 

Each D/A develop criteria/playbooks that outline 
what happens internally to their organizations 
when the HSAS threat level is raised. 

DHS& 

Interagency 

6 Months 
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APPENDIX C: COMPILATION OF D/A LESSONS LEARNED 

The tbUowing table shows the list of participating agencies. “QL” indicates those that 
commented on the quick look report, “LL” indicates those that submitted lessons learned, and 
“DC” indicates those that had a data collector or member of the CPX Evaluation Team present at 
their location, WE ALSO NEED TO INSERT THE LESSONS LEARNED HERE OR 
REFERENCE HOW THEY WILL BE PUBLISHED. 


AgittHSy 

QL 

LL 

DC 

Ameiican Red Cross 

X 

X 


Central Intelligence Agency 

X 

X 


Defense Information Systems Agency 




Department of Agriculture 




Department of Commerce 




Department of Defense 


X 


* Office of the Secretary of Defense 

X 



Department of Education 




Department of Energy 

X 

X 

X 

Department of Health and Human Services 



X 

Department of Homeland Security 



X (lAC, NJIC, NICC) 

. FEMA 



X (NRCC) 

• Civil Rights and Liberties 

X 



• Domestic Nuclear' Detection Office 

X 

X 

X 

• Immigration and Customs Enforcement 


X 


• Preparedness Directorate 

X 

X 


• National Communications System 


X 


• Office of Science and Technology 




• Transportation Security Administration 




• U.S. Citizenship and Immigration Services 




• U.S. Coast Guard 


X 

X 

• U.S. Customs and Border Protection 




• U.S. Secret Service 




Department of Housing and Urban Development 

X 

X 


Department of Interior 




Department of Justice 




• FBI 




• Criminal Division Counter Terrorism Section 




• Alcohol, Tobacco, Firearms, and Explosives 




• U.S. Marshals Service 




Department of Labor 

X 

X 


Department of State 

X 

X 


Department of the Treasui 7 




Department of Transportation 




• Federal Aviation Administration 




Department of Veterans Affairs 



X 
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Environmental Protection Agency 




Executive Office of the President 




• Office of Science and Technology Policy 




Export-Import Bank of the US 




Federal Communications Commission 

X 



Federal Reserve System 




General Services Administration 

X 



Internal Revenue Service 




Landport SIMCELL Collective 




National Archives and Records Administration 

1 



National Capital Region 


X 


• DCEMA 



X 

• Virginia DEM 




. MEMA 




• Supporting Jurisdictions and Agencies 

i 



National Labor Relations Board 




National Science Foundation 

X 

X 


National Transportation Safety Board 

i 



Nuclear Regulatory Commission 

1 



Office of Personnel Management 




Office of the Director of National Intelligence 




Office of the U.S. Courts 




Peace Corps 




Pension Benefit Guaranty Corporation 




Securities and Exchange Commission 




Small Business Administration 




Social Security Administration 

X 

X 


US Agency for International Development 




US Army Corps of Engineers 




US House of Representatives 




US Postal Service 

X 

X 


US Senate Office of the Sergeant at Arms 
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APPENDIX E: HSAS CONDITIONS 


Threat Conditions Procedures/ Guidelines 

Green (low)^ Blue (guarded), Under Threar CoiidiTions Green through Yd low. rhe HSOC raaintaias direct 

Yellow (elevated) connecd'vity with die NCTC and die FBI SIOC regarding the teTTorist threat and 

m ain Urns situationai awareness tlirougii liic continued naomtoring of reported 
incidents. 

Orange (high) when threat condidons warrant, DHS activates the IIMG Lo review the ihreaL 

iniomiabon, goordinate interagency activity and reConrutieiKi additional 
precautions needed to prevent, prepare ibr, or respond to an attack. If the threat 
is elevated regionally or locally. DHS considers designaung a PFO and activating 
emergency response teams and appropriate RXCC(s) to coordinate wiili 
regional, State, and private-sector endiies and notify (or activate) regional 
resources (such as the BET) as appropriate. 

Red (severe) When threat conditions warrant, DHS fnliy activates the NBCC. activates the 

RRCCs in the designated threat locations, implanencs Continuit)" of Operations 
plans, and places other appropriate assets on the highest alert status. If the 
lineal is elevated regionally or locally die IIMG provides recommend lEiom for 
the deploy meni of special leams lo the area and esLablishment of a JFO, In the 
absence of a JKX spedal teams deployed in response lo a terrorist threat operate 
in coordination with the FBI JOG. 
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APPENDIX F: COOP AND COGCON MATRIX 


DEPARTMENT AND AGENCY COOP ALERT & DEPLOYMENT OPTIONS 


Department & 

Agency (D/A) 
Continuity of 
Operations 
(COOP) 

“GUARDED’^ 

COGCON 4 

COGCON 3 

em 

COGCON 2 

“HIGH” 

COGCON 1 

Operations 

• Continue to perform headquarters 
Pusiness functions at normal 
locatk)n(s) 

• Maintain alternate operating 
facility(ies) in accordance with 
agency COOP plans to ensure 
ready for activation at all times 

• Conduct training and exercise 
activities in accordance with 
agency COOP and TTE pl3n(s) to 
ensure personnel readiness 

* Continue to perform 
headquarters business 
functions at normal 
lDcation(5) 

■ Maintain alternate 
operating facillty(ies) in 
accordance with agency 
COOP plans to ensure 
ready for activation at ail 
times 

• Conduct additional training 
activities to increase 
personnel readiness (e g. 
Team tabletops, review 
recall tists, review plans 
and Droceduresi 

• Continue to perform headquarters 
business functions at normal 
locabon(s) 

• Monitordrack major HQ activrties 

• Maintain alternate operating 
facilityfies) in accordance with agency 
COOP plans to ensure ready for 
activation at all times 

• Take appropriate steps to ensure 
alternate operating facility(ies) can be 
activated with 4 hours notice 

• Continue to perform 
headquarters 
business functions at 
normal location(s) 

• Monrtor/track major 

HQ activities 

• Perform day-to-day 
functions at alternate 
facilrtyties) as 
appropriate 

• Take appropriate 
steps to ensure 
alternate operating 
facilrty(ies) can be 
activated with no 
notice 

Staffing Level 

* No staffing required at alternate 
operating faciiity(ies) 

• Maintain normal delegations and 
devolution of authority to ensure 
perfomiance of essential 
functions in no notice event 

* No staffing required at 
alternate operating 
facility(ie$) unless 
necessary to meet 8-hour 
operational requirement. 

« Maintain normal 
delegations and devolution 
of authority to ensure 
performance of essential 
functions in no notice event 

■ Deploy sufficient staff to alternate 
operating tacility(ies) to allow 
activation with 4 hours notice 

• Deploy sufficient 
staffing to alternate 
operating facilFty<ies) 
to perfomi essential 
tunctions with no 
notice 
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DEPARTMENT AND AGENCY COOP ALERT & DEPLOYMENT OPTIONS 


Department & 
Agency (D/A) 
Continuity of 
Operations 
(COOP) 

“nt l&DnFn” Level of Cone 


ern ' “HIGH'’ 

COGCON 4 

COGCON 3 

COGCON 2 

COGCON 1 

Communications 

• Test all internal agency 
communications capabilities 
between normal operating 
locations (HQ and other) and 
alternate operating facjlity(ies) no 
less than quarterly 

• Test all communicatjons 
capabilities at all alternate 
operating f3cility{res) with 
applicable interagency partners 
no less than quarterly (e g. 
participate in Title Globe) 

• Conduct at least one 
additional internal agency 
communications test 
between normal operating 
locations (HQ and other) 
and alternate operating 
facilEty(ies) within 24 hours 

• Conduct internal agency 
communications tests between normal 
operating locations (HQ and other) 
and alternate operating facilityties) 
withrn 24 hours and repeat NLT 
weekly. 

• Conduct communications tests at all 
alternate operating faertityfies) with 
applicable interagency partners within 
48 hours and repeat NLT weekly 

* Test internal agency 
communications 
between normal 
operating locations 
(HQ and other) and 
alternate operating 
facilfty(ies) daily 

* Conduct 

communications tests 
at alt alternate 
operating facilityiies) 
with applicable 
interagency partners 
daily 

Succession 

• No special measures to protect or 
tracK location of agency 
leadership arxJ successors 
■ Ensure delegations of authority to 
lead D/A are in place for senior 
personnel located outside of 
national capital region. 

• Track locations of agency 
leadership and their 
successors on daily basis 

• Track locations of agency leadership 
and their successors on daily basis 

* Ensure at least one headquarters- 
level agency successor is out of 
national capital area at all times 

♦ Track locations of 
agency leadership and 
their successors on 
daily basis 

• At least one 
headquarters-level 
agency successor at 
alternate operating 
faciliryiies) 

Time to Transition 
to Successive 
Stages 

• Fully operational within 12 hours 

* Fully operational within 8 
hours 

* 4 hours to COGCON 2 

• Fully operational within 4 hours 
(4 hours to COGCON 1 ) 

• Agency headquarters 
COOP plan 
operational 
immediately 

Impact on 
Departments & 
Agencies 

• No additional requirements 

• Additional staff time for 
communications testing 
and tracking agency 
leadership 

• Potential shorter response 
times for basic staffing of 
alternate facili{y(ies) 

* Potential increased travel 
requirements for agency leadership 

* Some staff required to work from 
alternate [ocation(s) 

* Potential shorter response times for 
additional staffing of alternate 
facilityiles) 

• Some agency 
leadership work from 
alternate facility(ies) 

• Significant number of 
staff required to work 
from alternate 
location(s) 

Notification 

Process 

step 1 . White House Chief of Staff/Deputy Chief of Staff for Operations, '’WHMO Director notifies PEOC 

Step 2, PEOC notifies FOC 

Step 3. FOC notifies Department and Agency COOP Emergency Pointe of Contact and/or Emergency Operations Centers 
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DEPARTMENT AND AGENCY COOP ALERT & DEPLOYMENT OPTIONS 


COOP 

Notification 

Message 

White House Chief of Staff/Deputy Chief of Staff for Operations/Director White House Military Office to PEOC — 

“This is a Continuity of Operations message. Direct all department's and aqencies to assume a COGCON Z-4, ”-3. Z-2, Z-1 

{designate COGCON) 

readiness posture with the exception of those departments and agencies circled betow, who will assume a 

COGCON Z-4, Z-3, Z-2. Z-1 readiness posture,” 

{designate COGCON) 


Central Intelligence Agency 

Environmental Protection Agency 


Department of Agriculture 

Executive Office of the President 


Department of Commerce 

Federal Communications Commission 


Department of Defense 

Federal Emergency Management Agency 


Department of Education 

Federal Reserve System 


Department of Energy 

General Services Administration 


Department of Heattn Human Services 

National Aeronautics and Space Administration 


Department of Homeland Security 

National Archives and Records Admin 


Department of Housing Si Urban Development 

National Communications System 


Department of Justice 

Nuclear Regulatory Commission 


Department of Labor 

Office of Personnel Management 


Department of State 

Securities and Exchange Commission 


Department of trie Interior 

Social Security Administration 


Department of the Treasury 

US Army Corps of Engineers 


Department of Transportation 

Department of Veterans Affairs 

United States Postal Service 
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Improvement Plan (AAR/IP). 

2. The information gathered in this AAR/IP is designated as For Ofncial Use Only (FOUO) and 
should be handled as sensitive information. This document should be safeguarded, handled, 
transmitted, and stored in accordance with appropriate security directives. Reproduction of 
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4. Points of Contact (POCs): 

Federal POC: 

Mr. Bill McNally 

Director, National Exercise Division 
FEMA National Preparedness Directorate 
U.S. Department of Homeland Security 
Washington, DC 20536 
William.McNally@dhs.gov 

Exercise Director: 

Ms. Sandra Santa Cosgrove 
FEMA National Preparedness Directorate 
U.S. Department of Homeland Security 
Washington, DC 20536 
Sandra.Santa@dhs.gov 
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Executive Summary 

TOPOFF is a congressionally-mandated terrorism preparedness exercise program, involving top 
officials at every level of government, as well as representatives from the international 
community and the private sector. TOPOFF 4 (T4) was sponsored by DHS and is the fourth 
TOPOFF Exercise Series. Each TOPOFF series involves a two-year cycle of seminars, planning 
events, and exercises, and culminates in a full-scale assessment of the nation’s capacity to 
prevent, prepare for, respond to, and recover from terrorist attacks involving weapons of mass 
destruction {WMDs). 

More than one hundred organizations were involved in planning T4, including DHS and other 
federal agencies; state, territorial, tribal, and local agencies from the states of Arizona and 
Oregon and the U.S. Territory of Guam; private sector, and non-governmental organizations 
(NGOs); as well as three international partners: Australia, Canada, and the United Kingdom. The 
T4 FSE used a radiological dispersal device (RDD) scenario based on National Planning 
Scenario (NPS) 11 to test the full range of federal, state, temtorial, and local capabilities. This 
scenario included coordinated attacks in Guam, Oregon, and Arizona. 

A major goal of TOPOFF exercises is to test existing plans, policies, and procedures to identify 
planning and resource gaps, and ultimately to implement corrective actions to improve WMD 
preparedness. The following objectives guided planning for T4; 

• Prevention: To test the handling and flow of operational and time-critical intelligence 
between agencies to prevent a temorist incident. 

• Intelligence/ Investigation: To test the handling and flow of operational and time-critical 
intelligence between agencies prior to, and in response to, a linked terrorist incident. 

• Incident Management; To test the full range of existing procedures for domestic 
incident management of a terrorist WMD event and to improve top officials’ 

(federal/state /local) capabilities to respond in pai^t^^ersihip in accordance with the National 
Response Plan' (NRP) and National Incident Mi^jiflgi^nient System (NIMS). 

• Public Information; To practice the strategic coordination of media relations and public 
information issues in the context of a teiTorist WMD incident or incident of national 
significance (INS), 

• Evaluation: To identify lessons learned and promote best practices. 

Nearly every capability in the DHS Target Capabilities List (TCL) was exercised. This AAR 
focuses on national policy and planning issues related to five of those capabilities: On-Site 
Incident Management, Emergency Operations Center (EOC) Management, Emergency Public 
Information and Warning, Economic and Community Recovery, and Intelligence/Information 
Sharing and Dissemination. These capabilities were chosen because they relate to the objectives 
above and other criteria explained in Section 2. Other AARs completed by venues, agencies, and 
organizations evaluate additional capabilities. The purpose of this report is to analyze exercise 
results, identify strengths to be maintained and built upon, identity potential areas for further 
improvement, and support the development of corrective actions. 


' The NRP in effect at the time of the exercise, but was replaced by the Natienal Response Framework (NRF) in 
January of 2008 . 
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Major Strengths 

Past TOPOFF exercises and actual disasters such as Hun'icane Katrina have uncovered gaps in 
the nation’s preparedness. T4 provided an opportunity to test corrective actions taken since 
previous exercises and Hurricane Katrina.^ Our analysis highlighted several areas where 
improvement in response coordination was evident; 

• New policies and procedures provided additional detail to national plans. A significant 
issue identified in TOPOFF 3 (T3) and Hurricane Katrina is that national plans lacked 
operational details. Since these events, a significant amount of planning has occurred, and 
T4 provided an opportunity to test changes to the NRP, new Emergency Support 
Function (ESF) Standard Operating Procedures (SOPs), and new scenario-based plans 
and playbooks. 

• New federal teams and tools have been established to address specific shoilfalls 
identified in past TOPOFF exercises and during Hurricane Katrina. For example, the 
DHS Crisis Action Team (CAT) and Homeland Security Information Network (HSIN) 
Common Operating Picture (COP) portal were established to address a lack of shared 
situational awareness among agencies and were rigorously tested during the exercise. 

• There was robust private sector involvement in the exercise - more so than any previous 
TOPOFF exercise. This participation added realism to the exercise, helped identify areas 
where the private sector can contribute, and helped decision-makers consider and address 
the needs of the private sector in the context of this scenario, 

• Disability and other special needs play was a major focus area in the exercise design. As 
a result, players gained critical practical experience regarding the additional support 
needed by individuals having special needs. 

Some of the areas described above require further improvement. Nonetheless, these strengths 
represent progress in addressing previously identified gaps in the nation’s preparedness. 

Primary Areas for Improvement 

Throughout the exercise, opportunities for improvement in the nation’s ability to respond to a 
WMD incident were identified. These areas for improvement include recumng themes - issues 
that have been identified in previous TOPOFF exercises and during Hurricane Katrina - along 
with several new issues highlighted by this scenai'io. Many of the issues ai'e intertwined. Four 
key areas for improvement that also impacted other areas are summai'ized here. The report 
provides a detailed discussion of all areas for improvement. 

Unified Management of the National Response 

The White House Hurricane Katrina report identified the process for establishing unified 
management of the national response as a key flaw in emergency response. This process, as 
defined in the NRP, NIMS, and the newly released National Response Framework (NRF) 
includes the state and local command and coordination structures, and the federal command and 


^ All references to previous TOPOFF exercises and Hurricane Katrina are drawn from the T2 and T3 AARs, and the 
White House Homeland Security CounciFs February 2006 report, The Federal Response to Hurncane Katrina, 
Lessons Learned. 
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coordination structures established to support them. This process, as implemented, did not 
account for the complex set of conditions experienced during Katrina - large-scale devastation, 
competing needs, and insufficient resources. The conditions during T4 were different but equally 
complex. The scenario included the occuiTence of three teiTorist strikes in different locations, the 
use of devices that caused radiological contamination, and the limited supply of federal 
radiological assets. 

This complexity affected the establishment of unified command structures at the incident sites, 
where many local, state, territory, and federal responders arrived with different authorities, 
functions, and missions. It also impacted the larger coordination structure, which in addition to 
the incident site unified command, included local, state, and territory EOCs and Emergency 
Coordination Centers (ECCs); other unified commands; the federal Interim Operating Facilities 
(lOFs) and Joint Field Offices (JFOs); and other federal entities such as the Federal Radiological 
Monitoring and Assessment Center (FRMAC). Further contributing to the complexity, the 
Nucleai'/Radiological Incident Annex was the guiding document for the response, and federal 
responders had difficulty merging the roles and responsibilities outlined in this annex with the 
roles and responsibilities established through the NRP ESF structure. 

This problem was most evident in the Oregon venue, which established all components of the 
local, state, and federal response structure. In Oregon, communication and coordination 
between the multiple command and control nodes varied. The structure did not promote effective 
information flow and had a significant impact on top official decision-making, especially 
regarding the implementation of protective actions and public messaging. 

This complexity was also evident at federal headquarters command centers and the White House, 
where senior officials were deciding how to allocate scai'ce resources and implement protective 
measures to mitigate attacks in other locations. Although decisions were made and actions taken, 
there were no formal procedures that described how to support decision-making and disseminate 
the decisions to the federal interagency. 

At the national level, improvement in docti'ine and guidance is needed to help responders at all 
levels of government establish an effective unified management system in response to a complex 
event. Scenario-based plans and guidance are one step in addressing the factors unique to 
specific scenarios like an RDD event. These plans should also include processes for allocating 
scarce resources and include recommended protective actions. The implementation of the 
Nuclear/ Radiological Incident Annex within the ESF response structure and the NRF also needs 
review and clarification. Because eveiy state and tenitory has its own unique structures, 
authorities, and requirements, this national guidance should be implemented at the regional level 
through existing planning programs, and supported through existing training and exercise 
programs. 

Protective Action Decisions and Communicating Guidance to the Public 

Faced with similar information and scenarios, leaders in Arizona and Oregon made different 
decisions about protective actions (evacuation versus shelter-in-place). These were difficult 
choices that required decision-makers to act quickly while assessing scientific model results and 


■ In Arizona, all field components were simulated, and in Guam, some fietd components/functions were simulated. 
In addition, Guam does not have a local level of government, making it less likely to experience these problems. 
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conditions specific to their locality. Tlie mock media repeatedly questioned federal, state, and 
local officials about this disparity, and officials had difficulty explaining their decisions and why 
different actions were taken in different jurisdictions. Two factors contributed to this difficulty: 

• Communicating these decisions required the explanation of complex scientific 
information, such as the differences between short-term and long-term radiation 
exposure, and the interpretation of technical products like plume model results and 
deposition measurements. 

• It is the responsibility of local officials to explain their individual decisions, but no expert 
or official explained why different decisions were acceptable or why both sets of actions 
protected the public. Similar circumstances also occurred during T3. 

While protective actions are the responsibility of local jurisdictions, the federal government and 
scientific community should develop additional strategies for supporting local officials in 
explaining these decisions that address both of these points. 

Situational Awareness and the COP 

As observed in T3 and during Hurricane Katrina, departments and agencies (D/As) at all levels 
of government had difficulty obtaining critical information and maintaining situational 
awareness. Although the HSIN and COP portal provided easy access to some infonnation, other 
information elements were not readily available. Senior decision-makers were most interested in 
plume model results, casualty counts, information on protective actions, and the status of federal 
resources. With the exception of the plume model results, these information elements were 
among the most difficult for DHS to collect and disseminate. The use of multiple platforms, 
systems, and portals also complicated information sharing. Defining the most critical pieces of 
infomnation, identifying the sources, and developing processes for obtaining and verifying the 
information are necessfu'y to improve situational awareness and information sharing. 

Homeland Security Advisory System (HSAS) 

As observed during previous TOPOFF exercises, the purpose, definitions, and consequences of 
the HSAS threat levels are not clear. Changes to Red and Orange threat levels, in both specific 
locations and nationwide, led to many different interpretations of the intent of the change and 
few actions. However, sector-specific changes did cause specific protective actions to be taken 
by federal, state, territory, and local agencies. Better definitions of the HSAS levels are needed 
that include more detail about the actions to be taken with different changes in level and sector. 

Conclusion and Next Steps 

The overall exercise succeeded in highlighting improvements since previous exercises and 
Hurricane Katrina, as well as identifying areas requiring further development. At the After- 
Action Conference (AAC) held on January 15, 2008, participating agencies met to review the 
findings and recommendations in this AAR and draft corrective actions. The IP included in 
Appendix A lists the concctive actions. The DHS NEP has established a process for tracking and 
monitoring the implementation of these corrective actions. 
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Section 1 : Exercise Overview 

Exercise Details 

Exercise Name 

Top Officials 4 (TOPOFF 4) 

Type of Exercise 

Full-Scale Exercise (FSE) with functional and tabletop components 

Exercise Dates 

Arizona Prevention Component: September 1 7 — 28, 2007 
Oregon Prevention Component; September 24 - October lO, 2007 
Guam Prevention Component: October 1 - 12, 2007 
FSE: October 15-20, 2007 

Long-Term Recovery Tabletop Exercise (LTR TTX): December 4-5, 2007 

Duration 

Prevention Component: 26 days 

FSE: 6 days (Guam and Oregon conducted discussion-based exercises during the 
following week) 

LTR TTX: 2 days 

Location 

Arizona, Oregon, the U.S. Territory of Guam, the National Capital Region (NCR), other 
regional headquarters and commands, Australia, Canada, and the United Kingdom 

Sponsor 

Department of Homeland Security (DHS) 

Program 

National Exercise Program (NEP) 

Mission 

Prevent, Respond, and Recover 

Capabilities 

Intelligence/Information Sharing and Dissemination, On-Site Incident Management, 
Emergency Operations Center Management, Emergency Public Information and 
Warning, Economic and Community Recovery 

Scenario Type 

Radiological Dispersal Device (RDD) 
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Exercise Planning Team Leadership 


The names of the T4 Executive Steering Committee (ESC) members are listed below: 
Mr. Bill McNally, chair, DHS FEMA National Preparedness Directorate 


Supervisory Special Agent (SSA) |(^)(^) 
(FBI) 


Federal Bureau of Investigation 


Ms. I (^)(^) I Office of the Director of National Intelligence (ODNI) 

Mr. Steven Buntman, Department of Energy (DoE) 

Dr, Keith Holtermann, Department of Health and Human Services (HHS) 

Mr. Thomas MacKay (replaced Dr. Holtermann during the after-action process), HHS 


Mr. 

(b)(6) 


Office of the Secretary of Defense (OSD) 

LT COL 

(b)(6) 

Department of Defense (DoD), Joint Staff 

Mr. 

(b)(0) 


I Depai'tment of State (DoS) 

Mr. 

(b)(6) 


I Homeland Security Council (HSC) 

Mr. 

(b)(6) 

National Security Council (NSC) 


Ms. Sandra Santa Cosgrove was the exercise director. The lead planners from the venues and 
international community are listed below: 

Arizona Department of Emergency and Military Affairs, and 


Arizona: Ms. 


Mr. (t’KG) 


DHS 


Guam:LT 


Guam Homeland Security, Office of Civil Defense and Mr. 






Nathan Rodgers, DHS 

Oregon: Ms. Kelly-Jo Craigmiles, Oregon Emergency Management, and Mr. Jeremy 
Greenberg, DHS 


Australia: Mr. (b)(6) 


Canada: Mr. (b)(6) 


United Kingdom: Ms. 


I Attorney-General's Department 
I Public Safety Canada 

(b)(6) I Foreign & Commonwealth Office 


Participating Organizations 

The following federal departments, agencies, 

• Central Intelligence Agency (CIA) 

• Department of Agriculture 

• Department of Commerce, National 
Oceanic Atmospheric Administration 

• DoD 

. JFCOM 
. NORTHCOM 

• Office of the Secretary of 
Defense/J-7/ASD-HD 

. PACOM 

• STRATCOM 

• U.S. Army Coips of Engineers 

• DoE 


offices participated in the T4 FSE; 

■ National Nuclear Security 
Administration 

• HHS 

■ Centers for Disease Control, 
Emergency Response Directorate 

• Centers for Disease Control, 
Strategic National Stockpile 

■ Food and Drag Administration 

■ Office of the Assistant Secretary 
for Preparedness and Response 

• DHS 

■ Customs and Border Protection 


and 
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■ Domestic Nuclear Detection 
Office 

• Federal Emergency Management 
Agency (FEMA) 

■ Immigration and Customs 
Enforcement 

• National Citizen Corps 

■ National Cyber Security Division 

■ National Protection & Programs 
Directorate 

• Office for Civil Rights and Civil 
Liberties 

■ Office of Health Affairs 

■ Office of Infrastiaicture 
Protection 

• Office of Operations 
Coordination 

■ Private Sector Office 

• Science & Technology 

■ Transportation Security 
Administration (TSA) 

■ Terrorism Prevention Exercise 
Program (TPEP) 

■ U.S. Coast Guard (USCG) 

• Department of Housing and Urban 

Development 

• Department of Interior 


Top Officials 4 (TOPOFF 4) 

• Department of Justice (DoJ) 

■ FBI 

■ Bureau of Alcohol, Tobacco, 
FirealTns, and Explosives 

• Department of Labor 

■ Occupational Safety and Health 
Administration 

• DoS 

• Depaitment of Transportation (DoT) 

■ Federal Aviation Administration 
(FAA) 

• Department of Veterans Affairs 

• Environmental Protection Agency 
(EPA) 

• Genera] Services Administration 
(GSA) 

• National Communications System 

• National Guard Bureau 

• National Security Agency (NSA) 

• Nuclear Regulatory Commission 

• Office of Personnel Management 
(OPM) 

• ODNI 

• Small Business Administration 

• White House Staff 


The following private sector entities and NGOs participated at the national level: 


Full Scale Exercise: 

• American International Group, Inc. 

• American Red Cross (ARC) 

• AT&T 

• BENS 

• Cisco 

• City of Dallas Convention/Evenl 
Services 

• Computer Sciences Corporation 
(Simulation Cell (SIMCELL), VIP) 

• Grocery Manufacturer's Association 

Functional Exercise: 

• AMWA 


• HMC see 

• IIT 

• IT-ISAC Operations Center 

• Juniper Networks, Inc. 

• L-3 Communications, Technical and 
Management Services Group 

• Terre Star Networks Inc. 

• Wal-Mart Stores, Inc. 


• Boeing Company, The 
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• 

FS-ISAC 


• 

Water JSAC 

• 

Nortel Government Solutions 


• 

Water sector utilities (looking glass) 

Tabletop Exercise: 




• 

Accenture 


m 

International Association of 


American Trucking Associations - 



Assembly Managers (looking glass) 


Highway ISAC 


• 

Raytheon 

• 

DRS Technologies 


• 

U.S. Chamber of Commerce 

Looking Glass: 




• 

Access Systems Inc. 


# 

Macerich Company 


Adidas America Inc. 


• 

Marriott Employees’ Federal Credit 

• 

Admiral Security 



Union 

• 

AIG 


• 

Marriott International 

• 

Alliant Group, The 


m 

Marsh 

• 

ANSI 


• 

Mississippi State University, 

• 

Avon Products 



GeoResources Institute 

• 

BAE Systems 


m 

Morgan Stanley 

• 

Beacon Capital 


• 

National Apartment Association 

m 

Bechtel National, Inc. 


m 

National Multi Housing Council 

m 

BOMA International 


• 

National Petrochemical & Refiners 

m 

Boston Properties 



Association 

» 

BP North America 


• 

National Sheriffs Association 

• 

Brookfield Properties 


• 

New Jersey Business Force - 

m 

CB Richard Ellis 



Business Executives for National 

m 

CellExchange 



Security 

• 

Corporate Storyteller, The 


• 

NJ Resources 

• 

Cousins Properties Incorporated 


• 

Nuclear Energy Institute 

• 

Cushman & Wakefield 


• 

NYC DEP 

• 

DRS-TSI Inc. 


• 

OOIDA 

• 

Ericsson Inc. 


• 

Oracle 

• 

FSSCC 


« 

PepsiCo, Inc. 

• 

General Electric 


« 

Port Authority of New York and 

• 

GeoResources Institute, 



New Jersey 


Mississippi State University 


m 

PREIT 

• 

Hines 


• 

Previstar 

• 

Honeywell 


m 

Professional Security Consultants 

m 

Institute of Real Estate 


m 

Raley's Family of Fine Store 


Management 


• 

Real Estate Roundtable, The 

m 

International Council of Shopping 


• 

Real Estate Roundtable/Real Estate 


Centers 



ISAC 

• 

Jones Lang LaSalle 


• 

Related Management 

• 

Lockheed Martin 


• 

SAIC 
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• Sentinel Real Estate Corp. 

• Simon Property Group 

• South Coast Plaza Security 

• Starwood Hotels & Resorts 
Worldwide, Inc. 


Top Officials 4 (TOPOFF 4) 

• Target Corporation 

• Tishman Speyer 

• UDR 

• Washington Group International 


International participating agencies included the following: 


Australia 

• Attorney-General ’ s Department 

• Australian Customs Service 

• Australian Federal Police 

• Australian Nuclear Science and 
Technology Organisation 

• Australian Radiation Protection and 
Nuclear' Safety Agency 

• Australian Security Intelligence 
Organisation 

• Department of Defence 

• Department of Foreign Affairs and 
Trade 

• Department of Health and Ageing 

• Department of Immigration and 
Citizenship 

• Department of Prime Minister and 
Cabinet 

• Emergency Management Australia 

• Inter-Departmental Emergency Task 
Force 

• National Security Committee of 
Cabinet 

• National Crisis Committee 

• Protective Security Coordination 
Centre 

Canada 

• Agriculture Canada 

• Canadian Nuclear Safety 
Commission 

• Canadian Border Services Agency 


• Canadian Security Intelligence 
Service 

• Citizenship and Immigration 

• Communications Security 
Establishment 

• Depai'tment of National Defence 

• Foreign Affairs and Internationa] 
Trade Canada 

• Government Operations Centre 

• Industry Canada 

• Natural Resources Canada 

• Public Health Agency of Canada 

• Public Safety Canada 

• Public Works and Government 
Services Canada 

• Royal Canadian Mounted Police 

• Service Canada 

• Transport Canada 

United Kingdom 

• Cabinet Office (including Civil 
Contingencies Secretariat) 

• Foreign & Commonwealth Office 

• Home Office 

• Department for Transport 

• Department of Health 

• Department for Culture, Media & 
Sport 

• Health Protection Agency 

• Metropolitan Police CT Cmd (SO 15) 
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Participating agencies in Arizona included the following: 


State and Local: 

• Arizona Attorney General’s Office 

• Arizona Corporation Cominission 

• Arizona Counter TeiTorism 
Information Center 

• Arizona Department of 
Administration 

• Arizona Department of Agriculture 

• Arizona Department of Corrections 

• Arizona Department of Economic 
Security 

• Arizona Department of Emergency 
and Military Affairs 

• Arizona Department of 
Environmental Quality 

• Arizorra Department of Health 
Services 

• Arizona Department of Homeland 
Security 

• Arizona Department of Housing 

• Arizona Department of Juvenile 
Corrections 

• Arizona Department of Occupational 
Safety and Health 

• Arizona Department of Public Safety 

• Arizona Department of Revenue 

• Arizona Department of 
Transportation 

• Arizona Department of Water 
Resources 

• Arizona Fish and Game 

• Arizona Health Care Cost 
Containment System 

• Arizona Medical Board 

• Arizona Office of the Governor 

• Arizona Radiation Regulatory 
Agency 

• Arizona Registrar of Contracts 

• Arizona State University 


• Business Operations Center — 
Arizona (approximately 20 
participating organizations) 

• City of Avondale 

• City of Chandler 

• City of Glendale 

• City of Goodyear 

• City of Litchfield Park 

• City of Mesa 

• CityofTempe 

• City of Peoria 

• City of Phoenix 

• City of Scottsdale 

• City of Surprise 

• City of Tucson 

• Fort McDowell Indian Community 

• Fountain Hills 

• Gila River Indian Community 

• La Paz County 

• Maricopa County Department of 
Emergency Management 

• Maricopa County Public Health 

• Metropolitan Medical Response 
System 

• Phoenix Aviation (Sky Harbor 
International Airport) 

• Phoenix VAMC 

• Pima County Emergency 
Management 

• Pima County Sheriff’s Office 

• Pinal County 

• Salt River Pima Indian Community 

• Town of Buckdale (limited 
participation) 

• Town of Gilbert 

• Tucson Airport Authority 

• Tucson VAMC 

• Yavapai County 
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Federal: 



• 

EPA 

9 

U.S, Customs and Border Protection 


DHS 

9 

U.S. Postal Service 


■ FEMA, Region IX 

9 

U.S. Postal Inspection Service 

m 

DoJ 

9 

U.S. Veteran’s Affairs 


■ FBI 

9 

VA Network (VISN) 

• 

TSA 



Private Seetor/NGO: 



• 

AT&T 

9 

Phoenix Children’s Hospital 

• 

Banner Health Hospitals 

9 

Southern Arizona Chapter of the 

• 

Boswell 


ARC 

• 

Cox Cable 

9 

Sun Health Care Hospitals 

• 

Del Web 

9 

The Salvation Army 

• 

Grand Canyon Chapter of the ARC 

9 

Verizon Wireless 

• 

Intel Corp 



Pai'ticipating agencies in Guam included the following: 



State and Local: 



m 

Guam Airport Authority 

9 

Guam National Guard 

m 

Guam Airport Authority Police 

9 

Guam Police Department 

9 

GUAMCELL 

9 

Guam Port Authority 

9 

Guam Customs and Quarantine 

9 

Guam Telephone Authority 

• 

Guam Department of Corrections 

9 

Guam Visitors’ Bureau 

9 

Guam Department of Mental Health 

9 

Hawaii National Guard 


and Substance Abuse 

9 

Guam Homeland Security/Office of 

9 

Guam Department of Public Health 


Civil Defense (GHS/OCD) 


and Social Services 

9 

Judiciary of Guam 

9 

Guam Department of Public Works 

9 

Office of the Governor 

9 

Guam EPA 

9 

Public Schools System 

9 

Guam Fire Department 



Federal: 



• 

DoD 


. USCG 


■ U.S. Air Force 


• Office of Infrastructure 


■ U.S. Army Coips of Engineers 


Protection 


• U.S. Navy 


■ Office of Public Affairs 


■ U.S. Pacific Command/Joint 

9 

DoJ 


Task Force - Homeland Defense 


• Attorney General’s Office 

• 

DoE 


• Bureau of Alcohol, Tobacco, 

• 

HHS 


Firearms, and Explosives 

9 

DHS 


- FBI 


■ FEMA 


• Secret Service 
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• 

Department of Labor 

• 

United States Postal Inspection 

• 

DoS 


Service 

• 

EPA 



• 

Military Sealift Command, LLC 



m 

National Weather Service 



m 

Small Business Administration 



Private Sector/NGO: 



• 

ARC 



• 

Casamar, Incorporated 

• 

Janus Marketing 

• 

Continental 

• 

Matson Shipping 

• 

Goodwind Development Corp 

• 

Micronesian Divers Assoc. Inc. 

# 

Group 4 Securicor 

• 

Mobile 

• 

Guam Hotel and Restaurant 

9 

Payless Markets 


Association 

9 

Peterra, Inc. 

m 

Guam Mami, Incorporated 

9 

Shell 


Guam Memorial Hospital 

9 

South Pacific Petroleum Corporation 

• 

Guam Power Authority 

9 

The Salvation Army 

m 

Guam Surgical Center 

9 

University of Guam Nursing 

m 

Hawaiian Rock Products 


Program 

m 

Horizon Lines 



• 

IConnect 



• 

IT&E 



Participating agencies in Oregon included the followint 

r; 


State and Local: 



* 

Beaverton City Emergency 

• 

Hillsboro Emergency Management 


Management 

• 

Hillsboro Fire 

m 

Tigard City Emergency Management 

• 

Multnomah County Health 

m 

Clackamas County Emergency 


Department 


Management 

• 

Multnomah County Sheriff 

m 

Clark Regional Regional Emergency 

9 

Multnomah County Emergency 


Services Agency 


Management 

• 

Coinmbia County 9 1 1 

9 

Oregon Department of Agriculture 

• 

Columbia County Emergency 

9 

Oregon Department of State Lands 


Management 

9 

Oregon DoT 

• 

Columbia River Fire & Rescue 

9 

Oregon Disaster Medical Assistance 

m 

Gresham Emergency Management 


Team 

9 

Gresham Fire 

9 

Oregon Health & Science University 

9 

Gresham Police 

9 

Oregon National Guard 

• 

Hillsboro City Emergency 


■ 102"^^ Civil Support Team 


Management 

9 

Oregon Occupational Safety and 
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Health Administration 

• Oregon Office of Disability 

• Oregon Office of Emergency 
Management 

• Oregon Office of Vocational 
Rehabilitation Services 

• Oregon Public Health 

• Oregon State Fire Marshal 

• Oregon State Police 

• Oregon State Public Health 

• OREN 

• Port of Portland 

• Portland Bureau of Emergency 
Communications 

• Portland Department of 
Transportation 

• Portland Fire 

• Portland Metropolitan Exposition 
Center 

• Ponland Office of Emergency 
Management 

• Portland Police 

• Portland VAMC 

• Washington County 91 1 

• Washington County Emergency 

Private Sector/NGO: 

• ACS 

• ARC 

• Ashforth Pacific 

• AT&T 

• Columbia River Steamship 
Operators Assistance 

• Easter Seals Oregon 

• Glimcher 

• Guide Dogs for the Blind 

• Hilton Hotels 

• Hospitals 

■ Adventist Medical Center 
• Kaiser Interstate Clinic 

■ Kaiser Regional Coordination 
Center 

■ Kaiser Sunnyside Hospital 


Top Officials 4 (TOPOFF 4) 

Management 

Federal: 

• Depai’tment of Agriculture 

• Department of Commerce 

■ National Oceanic and 
Atmospheric Administration, 
National Weather Service 

• DoD 

. NORTHCOM-CAE 

• Defense Threat Reduction 
Agency (DTRA) 

• DoE 

• HHS 

• DoJ 

■ FBI 

• DHS 

• Customs and Border Protection 

■ FEMA 

• Federal Protective Service 

■ TSA 

. USCG 

• DoS 

• EPA 

• VISN 20 Network Control Center 


• Legacy Coordination Center 

• Legacy Emmanuel Hospital 

• Legacy Good Samaritan Hospital 

• Legacy Meridian Park Hospital 

• Legacy Mount Hood Hospital 

• Legacy Salmon Creek Hospital 

■ Providence Milwaukie Hospital 

■ Providence Portland Hospital 

• Providence St. Vincent Hospital 

■ Regional Hospital 

■ Shriner’s Hospital 

■ SW Washington Hospital 

• Tuality Community Forest Grove 
Hospital 

■ Tuality Community Hillsboro 
Hospital 

• Willamette Falls Hospital 
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• 

Independent Living Resources 

• RAZ Transportation 

• 

Intel 

• Rehabilitation Institute of Oregon 

• 

Job Development Network 

• Schnitzer Steel Coip 

• 

Liberty Northwest 

• Shaver Transportation 

• 

Lloyd Center Mall 

• Standard Insurance 

• 

Macy’s 

• Terrestar 

• 

Metro West Ambulance 

• T-Mobile 

• 

Nextel 

• TriMet 

• 

Northwest Natural 

• TVF&R 

# 

Novation 

• University Health System 

m 

ON Semiconductor 

Consortium 

m 

Oregon Convention Center 

• U.S. Bank 

• 

Owens & Minor 

• Wal-Mart 

• 

PacifiCorp 

• XEROX 

• 

PGE 


• 

Owest 



Number of Participants 


Participant' 

Arizona 

Guam 

Oregon 

Federal 

Interagency 

International 

Total 

Players 

2,000 

1,890 

10,640 

3,280 

280 

18,090 

Controllers 

350 

140 

550 

250 

50 

1,340 

Evaluators 

150 

60 

270 

150 

35 

665 

Observers 

80 

80 

30 

440 

65 

695 

Victim Role Players 

0 

200 

2,760 

0 

0 

2,960 


2,580 

2,370 

14,250 

4,120 

430 

23,750 


' Private sector pailicipant totals are contained within the totals shown. 
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Section 2: Exercise Design Summary 

Exercise Purpose and Design 

T4 was comprised of a series of exercises and activities, including seminars and conferences that 
took place over a two-year period and culminated in the FSE, conducted from October 15 
through October 20, 2007. The T4 FSE was designed to serve several important functions: it 
addressed national counter-terrorism strategy; it exercised the national ability to prevent, respond 
to, and recover from a series of coordinated and geographically dispersed terrorist threats and 
acts; and it engaged senior officials from federal, state, territory, tribal, and local jurisdictions, as 
well as partner nations. The DHS FEMA National Exercise Division (NED) was the lead agency 
for T4 planning. Other agencies with counter-teirorism duties were invited to participate. 

The T4 exercise design included three primary components: 

• A series of national training seminars, 

• Extended prevention-centered exercise play. 

• An FSE designed to test the performance of products and processes. 

The T4 FSE was a multi-agency, multi-site, domestic counter-ten'orism event that simulated 
WMD terrorist incidents in Arizona, Guam, and Oregon. In addition, T4 included the 
participation of the governments of Australia, Canada, and the United Kingdom. T4 provided 
DHS and other federal, state, territory, tribal, and local D/As with an opportunity to exercise and 
evaluate the implementation of doctrine established in the NRP, the NIMS, and supporting 
policies and procedures. 

The FSE began with a simulated RDD detonation in 
Guam on the morning of October 16, 2007 (the 
evening of October 15 on the East Coast). 

Simulated detonations occurred in Oregon and 
Arizona on the following day (October 16). DHS 
planners worked with the venues and the 
interagency group to determine the best hours and 
days of exercise play. The end of the exercise 
(ENDEX) occurred on October 20, 2007. Hot wash 
and short-term recovery events followed in each of 
the venues. The LTR TTX was held on December 4 
— 5, 2007, and addressed short- and long-term 
recovery issues. 

Exercise Planning and Management 

The planning and management of the T4 FSE was an integrated effort among the major exercise 
planners and sponsors. The exercise management structure and its working groups are illustrated 
in Figure 2.1. Each major planner and sponsor had a voting representative in each of the 
positions described below. This integrated planning approach provided a mechanism to 



Simulated RDD detonation in Guam on October 
16, 2007. 
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coordinate planning efforts by DHS and its components, DoD, DoE, DoS, EPA, FBI, HHS, and 
other T4 FSE interagency partners. 

Figure 2.1: Exercise Management Structure 



The ESC was responsible for overall exercise oversight. Members ensured that planning efforts 
were coordinated among the working groups, were communicated to policy makers, and 
reflected policy guidance. Specifically^ the ESC supported the following functions: 

• Coordinated and integrated the efforts of the working groups and venues to create a 
coherent exercise design that met the policy and strategic-level objectives of 
stakeholders. 

• Provided guidance to working groups, including guidance for the adaptation of NPS 1 1 to 
support exercise objectives. 

• Reviewed and approved working group products and exercise documentation, including 
the scenario, Universal Adversary (UA) threat models, exercise intelligence products, the 
Master Scenario Events List (MSEL), the Exercise Plan (EXPLAN), the Control Staff 
Instructions (COSIN), and the Evaluation Plan (EVALPLAN). 

• Adjudicated conflicts or discrepancies among working groups regarding their products. 

• Provided periodic updates on the progress of exercise design and development to senior 
policy makers. 

• Ensured, through the exercise director, shared awareness of ongoing exercise design and 
development efforts among exercise planners. 

The roles of the exercise working groups were as follows: 

• The Control and Evaluation Working Group (CEWG) worked with agencies to ensure 
that the EXPLAN incorporated the respective D/A training objectives. The Master 
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EXPLAN contained all the essential exercise products, such as the COSIN and the 
EVALPLAN. Additionally, the CEWG planned and executed the training program for 
over 2,000 controllers and evaluators responsible for supporting the exercise. 

• The Intelligence Working Group (IWG) planned and coordinated all aspects of 
intelligence play for the exercise. 

• The Scenario Working Group (SWG) planned and coordinated all aspects of scenario 
development for the exercise, and ensured a plausible and realistic scenario that 
supported evaluation of selected national capabilities, 

• The Cyber Working Group (CWG) designed and developed the cyber component of the 
T4 exercise. 

• The Private Sector Working Group (PSWG) planned and coordinated all aspects of 
private sector play in the exercise. 

• The External Affairs Working Group (EAWG) planned and coordinated all aspects of 
Public Information Officer (PIO) participation in and support of the exercise. 

• The International Working Group supported the inteniational partner and U.S. embassy 
involvement in the exercise, and coordinated international participation with U.S. 
government (USG) D/As. 

Exercise Objectives, Capabilities, and Activities 

The overarching T4 FSE exercise objectives were; 

• Prevention: To test the handling and flow of operational and time-critical intelligence 
between agencies to prevent a teiTorist incident. 

• Incident Management; To test the full range of existing procedures for domestic 
incident management of a WMD terrorist event and to improve the capabilities of federal, 
state, tenitory, and local top officials to respond cooperatively and in accordance with the 
NRP and NIMS. 

• Intelligence/ Inve.stigation: To test the handling and flow of operational and time-critical 
intelligence between agencies prior to, and in response to, a linked terrorist incident. 

• Public Information: To practice the strategic coordination of media relations and public 
information issues in the context of a WMD terrorist incident or incident of national 
significance. 

• Evaluation: To identify lessons learned and promote best practices. 

Based on these overarching objectives, the planning team selected specific objectives linked to 
top official/interagency decision-making, interagency coordination, and the execution of 
national-level plans, They were selected because they met one or more of the following criteria: 

• They related to the T4 goals, objectives, and underlying themes. 

• They related to HSC direction to exercise NPS 11. 

• They have been identified as issues in past TOPOFF or other national-level exercises, 

• They have been identified as issues following Hurricane Katrina. 

• They related to the National Preparedness Goal and its priorities. 
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These specific objectives are the focus of this AAR and are listed below along with the 
corresponding capabilities and activities (for a more detailed description of these objectives, see 
the EVALPLAN): 

• Objective 1 : Test existing procedures for domestic incident management of a terrorist 
RDD event and top officials’ capabilities to respond in partnership in accordance with the 
NRP and NIMS. 

■ On-Site Incident Management: Implement on-site incident management; establish 
full on-site incident command; resource management; develop incident action plan, 
and evaluate/revise plans. 

• EOC Management: Identify and address issues; prioritize and provide resources; and 
support and coordinate response. 

• Objective 2: Test the ability of command, operations, and intelligence centers to share 
intelligence and information and maintain a COP. 

■ EOC Management: Gather and provide information. 

■ Intelligence/Information Sharing and Dissemination: Conduct vertical flow of 
infoimation; conduct horizontal flow of information. 

• Objective 3: Exercise the authorities, responsibilities, and capabilities of the federal 
assets necessary to respond to and recover from a terrorist RDD incident. 

■ On-Site Incident Management: Implement on-site incident management; establish 
full on-site incident command; and resource management. 

■ EOC Management: Identify and address issues; prioritize and provide resources; and 
support and coordinate response. 

■ Economic and Community Recovery: Direct economic and community recovery 
operations. 

• Objective 4: Examine the handling of mental health and special needs issues that may 
arise during and after an RDD event. 

■ On-Site Incident Management: Implement on-site incident management. 

- EOC Management: Identify and address issues; prioritize and provide resources; and 
support and coordinate response. 

• Objective 5: Examine citizen protection and public warning activities in response to a 
teiTorist RDD incident. 

■ Emergency Public Information and Warning: Manage emergency public 
information and warning; activate emergency public information, alert/waming, and 
notification plans; establish Joint Information Center (JIC)/ Joint Information System 
(JIS); disseminate/issue emergency public infomiation and alert/wamings; and 
conduct media relations. 

• Objective 6: Examine public health, medical support, mass decontamination, and mass 
care requirements during a terrorist RDD incident. 

• On-Site Incident Management: Implement on-site incident management; establish 
full on-site incident command; and resource management. 
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■ EOC Management; Identify and address issues; prioritize and provide resources; and 
support and coordinate response. 

• Objective 7: Exercise the coordination of a domestic and international media and public 
communications strategy and public messaging in the context of a tenwist RDD incident. 

■ EOC Management; Gather and provide information; and support and coordinate 
response. 

■ Emergency Public Information and Warning; Manage emergency public 
information and warning; activate emergency public information, alert/warning, and 
notification plans; establish JIC/ JIS; disseminate/issue emergency public information 
and alert/wamings; and conduct media relations. 

These objectives link to five of the capabilities in the TCL. Additional capabilities were 
exercised that relate to specific agency missions and tactical level operations. They are evaluated 
in venue and other internal agency evaluations. Some of these evaluations ai'e included as 
annexes to this report. 

Scenario Summary 

The T4 FSE Scenario was based on NPS 1 1 (Radiological Attack - Radiological Dispersal 
Devices) and its associated UA threat models. Used as a common foundation for exercise 
development, the scenario - complemented by current threat infonnation about the UA - ensured 
that exercise participants focused on performing the appropriate critical tasks and assessed 
capabilities linked to specific homeland security mission areas. 

In the T4 FSE Scenario, terrorist members of the UA group acquired radiological sources from 
foreign locations. The source materials were smuggled into the United States via separate 
shipments and then assembled. A Customs and Border Patrol exercise conducted prior to the 
start of the FSE focused on procedures in place to intercept radiological materials and is 
documented in Annex 2. 

Two of the most visible features of the T4 FSE scenario were the Virtual News Network (VNN) 
Live news broadcast and VNN.com. VNN Live provided a satellite broadcast of news of events 
and interviews with subject matter experts (SMEs) as they occurred during the conduct of the T4 
FSE. VNN.com complemented intelligence play by providing the media perspective on events 
that occurred prior to and during the T4 FSE. 

The following scenai'io assumptions applied to the FSE: 

• The scenario was plausible, and the events occurred as they were presented. 

• Exercise players were well-versed in their own response operations, including plans and 
procedures. 

• Exercise players responded in accordance with their existing plans, policies, procedures, 
and capabilities. 

• All information provided in the narrative and/or by controllers was considered valid. 

• There were no controlled time compressions, although the levels of play varied among 
agencies as discussed below. 
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The following artificialities and constraints were accepted to facilitate accomplishment of the 

exercise objectives. They may have detracted from exercise realism and also affect the analysis. 

• Weather and atmospheric conditions at key points in the exercise were artificially defined 
to create a specific dispersal pattern of the agents involved in the exercise event. This was 
necessary to drive exercise play to meet the agreed-upon overarching and agency-specific 
exercise objectives determined during the T4 FSE planning process. 

• Surrogates may have played in place of some key decision makers. The surrogates, in 
most instances, were junior to the principals they represented. Thus, the surrogates’ 
actions during the exercise might not have depicted the same actions that would have 
been taken by their respective principals. 

• Agencies, departments, and organizations not participating in the T4 FSE were simulated 
through the use of a SIMCELL. The SIMCELL representation of those non-partieipating 
agencies was determined by the agencies’ published policies, procedures, and doctrine. 

• VNN coverage was limited to eight hours per day, whereas real-world news outlets 
would have operated ai'ound the clock. This limitation was particularly significant in 
Guam, which, due to the time difference, received only four hours of live VNN average 
per day. In addition, the schedule of VNN was partly scripted, which limited the ability of 
PIOs to quickly air unscheduled statements and interviews. 

• The levels and hours of play arnong agencies and organizations varied. Most agencies did 
not participate on a 24-hour basis. Some of the most notable gaps included the following: 

• There was no play overnight at the incident site in Oregon. Play halted on the evening 
of the first day just as some federal assets were andving on scene. 

■ Rescue play was halted on October 16 in Oregon because volunteer victims were in 
unsafe conditions due to inclement weather. 

■ Play in Oregon was halted on October 18 at 1450 PDT until the following morning 
for safety reasons. 

■ Coordination and communication between players in Guam and other venues was 
limited because of the time difference and lack of participation overnight in the other 
venues. 

■ In Guam, the initial site assessment mission was completed within the first day of the 
exercise, but follow-on radiological deposition data collection activities were all 
notional due to a lack of players. 

■ In Guam, the National Guard Civil Support Team (CST) completed their T4 
objectives, and concluded their “boots on the ground” participation the morning of 
the second day of the exercise, prior to the initiation of the law enforcement activities 
and follow-on radiological deposition data collection (and before the other federal 
agencies arrived). 

■ In Guam. Public Health reduced their level of play after their life saving/life safety 
mission was completed. 

• In Guam, representatives from DoE were deployed to represent full teams. 

• There were several artificialities related to the collection of radiological data. Some of the 
most notable issues included the following: 

■ In Oregon and Guam, radiological data collected in the field was often at a notional 
site. The Guam venue (unlike Oregon) did not have a pre-defined requirement or 
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sufficient resources to perfonn the conversion of location of field data gathered by 
local agencies and the CSTs. 

■ In Oregon, radiological data collection required a DoE controller equipped with a 
handheld device that provided GPS-linked data. There were not enough controllers to 
allow for simultaneous site assessment at both the incident site and downwind 
locations. 

■ In Arizona, radiological data collection activities were notional. 

Exercise Evaluation Methodology 

The evaluation approach for T4 is based on the methodology outlined in Homeland Security 
Exercise and Evaluation Program (HSEEP) doctrine and the methodology used in previous 
TOPOFF exercises. Observation and data collection identifies what happened during the exercise 
and when it happened. Findings and recommendations aj'e then developed through reconstruction 
and analysis.' This overarching analysis focuses on interagency issues and coordination as put 
forth in the NRP, NIMS, and supporting itolicies and procedures. The analysis and AAR does not 
examine D/A-specific tasks, procedures, or performance. Many D/As conducted supporting 
evaluations and analyses of their exercise performance. This analysis uses and references some 
of these supporting evaluations. 

HSEEP provides the common evaluation standards and was applied to the TOPOFF 4 evaluation 
as described in the EVALPLAN, Annex B of the T4 EXPLAN. The focus on interagency issues 
and coordination requires the synthesis and analysis of data collected from many different sites. 
For this reason, evaluation of T4 is a process that does not take place in individual exercise 
locations. Rather, data and observations collected from individual locations are consolidated, 
synchronized, and de-conflicted across locations so that evaluators can obtain a fact-based 
understanding of how agencies interacted to coordinate, make decisions, and execute national 
plans, policies, and procedures. Where gaps in the data existed, the evaluation team conducted 
post-exercise interviews with exercise participants to clarify exercise events. 

This evaluation is limited by the quality of the data collected, by the exercise artificialities 
described above, and by exercise design and development decisions.^ In the following analysis 
sections, it is noted where these limitations had an impact on the analysis. 


* Appendix D provides a summary rcconstruetion of key events. 

^ Annex 1 provides a summiny of lessons learned related to exercise design and development. 
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Section 3: Analysis of Capabilities 

This section reviews national policy and planning issues related to the five exercised capabilities 
that are the focus of this report: On-Site Incident Management, EOC Management, Emergency 
Public Information and Warning, Economic and Community Recovery, and Intelligence/ 
Information Sharing and Dissemination. 

The observations included in this report are organized by capability and corresponding activity, 
consistent with HSEEP guidelines. Within each activity are the related observations, including an 
analysis of that observation, and recommendations. ' An IP based on the recommendations from 
this AAR and validated at the A AC is found in Appendix A. References are compiled in 
Appendix C and a timeline of key exercise events is included in Appendix D. Exercise 
artificialities ai'e noted in the previous section on exercise design (Section 2). 

Common themes linking observations and recommendations across capabilities are evident. For 
example: 

• The challenges implementing incident site unified commands described under On-Site 
Incident Management form the basis of some of the coordination problems identified 
within the larger response structure (of which the incident site is one node), and are 
discussed under EOC Management. 

• These command and coordination problems affected decision making, information 
sharing, and public messaging, and link to other issues described under EOC 
Management and Public Information and Warning, such as the allocation of low density/ 
high demand (LD/HD) assets, the demanding federal interagency operational cycle, and 
the communication of protective action guidelines. 

• Information sharing and situational awareness challenges, described in EOC 
Management, affected all components of the response as well. One specific information 
management challenge, information overload experienced by PIOs, is also described 
under Public Information and Warning. Similar problems occurred in the sharing of 
intelligence information and are summarized under Intelligence/Information Sharing and 
Dissemination. 

• Under Public Information and Warning, the difficulty explaining to the public why 
different jurisdictions took different actions is described. A similar issue could arise 
during the recovery phase, where the site optimization process for selecting clean-up 
standards could lead to different outcomes across jurisdictions, and is discussed in 
Economic and Community Recovery, 

Capability 1 : On-Site Incident Management 

Capability Summary: On-site incident management is the capability to effectively direct and 
control incident manageinent activities by using the incident command system (ICS) consistent 
v^ithNIMS. 

This capability was exercised in Guam and Oregon as local agencies responded to the incident 


’ Recommendations tire included for aO improvemenL areas and those strengths that lead to recommendations. 
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scene to direct and control incident management activities. Local response lasted from several 
hours to several days as federal assets deployed to the incident sites in Oregon and Guam. 
Incident commands transitioned to unified commands to manage resources and coordinate with 
on-scene agencies and appropriate EOCs and ECCs. 

In both Guam and Oregon, the initial life safety mission was well executed, and first responders 
showed familiarity with basic incident command principles. In addition. National Guard WIVID 
CSTs, which are state or territory assets that are federally trained and supported, were well 
integrated In the response. However, as the response management became more complex and 
nuanced, and the impact more widespread, local, state, territory, and federal personnel had more 
difficulty implementing incidenl/nnified command principles. The table below provides a 
summary of the observations described under this capability along with associated 
recommendations, where applicable. 


Table 3.1 Summary of On-Site Incident Management Observations 


Observation 

Recommendation 

Activity 1.1: Implement On-Site Incident Management 

] . 1 .1 Strength: The initial life safety mission was well-executed by local, state, and territory 
responders. 

Activity 1.2: Establish Full On-Site Incident Command 

1 .2. 1 Area for Improvement: While the 
basic principles of NIMS-ICS are familiar to 
all emergency responders, there were 
challenges in implementing a command 
structure that met the needs of this complex 
RDD scenai'io. 

More detai led procedures and training are 
necessary to implement unified command in 
complex scenarios. This should be addressed 
within the federal family of plans under 
development as well as within regional 
planning and training programs. 

1 Activity 1.3: Resource Management 

1.3.1 Strength: National Guard WMD 

CSTs were valuable state and territory assets 
during these RDD incidents. 

Further develop the ability of CSTs to 
effectively integrate into specific WMD 
Hazardous Materials (HAZMAT) responses. 


Activity t.1 : Implement On-Site Incident Management 

Observation 1.1.1 Strength: The initial life safety mission was well-executed by local, 
state, and territory responders. Local law enforcement personnel integrated with other first 
responders to perform site security and evidence protection, which supported the FBI- led law 
enforcement investigation that followed. 

Analysis: Several first responders and homeland security policymakers in Guam and 
Oregon stated that first responder equipment, training, and exercising had progressed 
over the last several years, and greatly enhanced the ability of local assets to respond to a 
HAZMAT event. 

In Guam, the life safety mission began soon after detonation at 6:03 p.m. EDT on 
Monday, October 15 (8:03 a.m. on October 16 in Guam). During the first three hours. 
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multiple D/As were involved, including the Guam Fire Department (GFD), Guam Police 
Department (GPD), Guam Emergency Medical Services (EMS), Guam Public Health, 
and the Guam National Guard 94th CST (see Figure 3.1). All teams reported to the 
incident commander, a member of the GFD. Additionally, Air Force and Navy 
Emergency Response Teams (ERTs) (HAZMAT, Explosive Ordnance Disposal (EOD), 
and firefighting) responded to the scene to provide support. The incident site command 
was supported by GHS/OCD through a mobile command center and an EOC Liaison 
Officer (LNO). 



The life safety mission proceeded 
in a similar fashion in Portland. 
The Portland Police Bureau (PPB) 
responded to the incident within 
minutes after the explosion, and 
implemented incident command 
soon after. Incident command 
passed from the PPB to Portland 
Fire and Rescue (PFR) within an 
hour of the explosion. At that 
point, local PFR HAZMAT units 
were on scene, and were joined by 
the Oregon State Department of 
Human Services Public Health 
Division Radiation Protection 
Services (RPS) ERT and the 


Portland Fire and Rescue begins establishing Incident Command. 


Oregon National Guard 102nd CST within three hours. Together, they performed gross 
and technical decontamination on more than 150 casualties. PPB kept the incident site 
secure and preserved as much of the scene as possible for the ensuing law enforcement 
investigation. 

Activity 1.2; Establish Full On-Site Incident Command 

Observation 1.2.1 Area for Improvement: While the basic principles of NIMS-ICS are 
familiar to all emergency responders, there were challenges implementing a command 
structure that met the needs of this complex RDD scenario. These complexities included the 
following: 

• The long-term and technical nature of the response due to the presence of radiological 
contamination. 

• The requirements for many different types of missions, including establishing initial 
and ongoing scene safety, law enforcement incident investigation, evidence 
collection, radioactive deposition data collection, scene stabilization and hazard 
mitigation, and on-going scene recovery planning. 

• Participation by many different local, tribal, state, territory, and federal agencies in 
the response. 
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As a result, responders in both venues had difficulty establishing clear unified command 
structures that met the needs of all participating agencies, coordinating multiple missions, 
and transitioning between missions. This ted to delays in gathering and consolidating 
infonnation to support decision making about issues, such as protective action 
recommendations and resource needs, as well as planning for recovery. 

Analysis: Figure 3. 1 shows the progression of missions accomplished at the incident sites in 
both venues, along with the command structures that were established to support each response 
phase. For the most part, the three basic missions of life safety, law enforcement incident 
investigation, and scene recovery occurred sequentially with little overlap.^ 


Figure 3.1 Incident Site Mission Area Activities and Assets 
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* Field work was notional (see the discussion in Section 2 artificialities for more information). 
*’^DOESEO at BOC/IOF; EPA On-Scene Coordinator for environ mental response at inckleni site 


Two key issues emerged; 

• Distinction between incident/unified command and site control: In both 
venues, the FBI took control of the incident site after the conclusion of life safety 
activities to manage the law enforcement investigation. In Oregon, the FBI was 
part of a unified command; while in Guam, the FBI was the sole agency within 
incident command. In both cases, the FBI was perceived to be the lead agency for 
the entire response, and other activities, such as site assessment, were put on hold 
pending transition of command from the FBI to another agency. 

• Lack of flexibility to conduct missions simultaneously: The NIMS-ICS 
structures established initially for life safety, and later for the law enforcement 
investigation, did not allow for the flexibility to begin activities unique to an RDD 
incident, such as site assessment. Site assessment includes defining the 


~ 111 Guam, tile timing and sequence of missions during the exercise was impacted by the availability and 
pmlidpation uf key response agencies. However, participants indicated that the observed missions would still have 
occurred sequentiaily if this had been a real-world event. 
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radiological “footprint”, which includes the size, scope, and boundaries of the 
deposited material, to support the leadership when making decisions about public 
health and environmental protective actions and recovery. Although local 
responders in Guam (such as Navy EOD and the 94th CST) were available to 
begin initial site assessment and did collect some data, there was no 
comprehensive plan to define the size and scope of the incident until the EPA 
began developing a formal site assessment plan two days after the explosion. In 
Portland, CST and EPA responders initially assisted in the life safety mission. 
When DoE personnel arrived, site command was in transition from PER to FBI. 

As a result, DoE, EPA, Multnomah County Health Department, Oregon State 
RPS, and PER HAZMAT met separately to discuss the public health component 
of the response and the necessary site assessment inission.'* Soon thereafter, the 
incident site was shut down for the evening, which stalled the initiation of site 
assessment activities.^ The following day, the Federal Radiological Monitoring 
and Assessment Center (FRMAC) assumed responsibility for the site assessment 
mission.^ 

The two issues described above ted to delays in gathering and consolidating information 
to support decision making and issue identification and resolution. For example, 
additional site assessment data could have supported the development of protective action 
recommendations, prevented post-blast contamination of personnel and equipment, and 
supported federal resource requests. These problems also delayed clean-up and recovery 
planning and the consideration of issues such as the storage, transport, and disposal of 
contaminated material, and the need for additional laboratory surge capacity. 

Similar problems establishing efficient on-site incident command structures were 
observed in T2 and T3. Furthermore, these problems are part of a larger issue of unified 
coordination across all levels of government, of which incident sites are one such node. 
This issue is discussed further in observation 2.3.4. 

Rocommendations: This exercise demonstrated that more detailed planning is 
necessary to prepare local, state, and territory responders to implement on-site unified 
command in complex scenarios. This should be addressed within the federal family of 
plans under development, as well as within regional planning and training programs. 
Regional planning is important for developing unified command structures that meet the 
needs of all agencies and missions within speciEc scenarios and account for the unique 
chai'acteristics of different localities. 

1 . National scenario-based guidance (linked to the national planning scenarios) 
should be developed to support NIMS implementation. DHS should establish an 
interagency working group with appropriate SMEs and first responders from the 
local, state, tribal, territory, and federal levels to help develop this guidance. The 


^ See Section 2 for a discussion of ailificialities related to data reporting by the CST. 

Coordination between the incident site unified command and the public health unified command is discu.s.sed in 
more detail in observation 2.3.4. 

^ See Section 2 for a discussion of ailificialities related to radiological data collection in Oregon, 

^ FRMAC management of site assessment is discussed in more detail in observations 2.1.3 and 2.1.4. 
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guidance should identify scenario-specific mission needs and provide a more 
detailed framework for establishing unified command structures that address all of 
these needs. Figure 3.2 shows an example of such a command structure; one that 
provides flexibility to support the needs of multiple missions in the context of this 
scenario. In this context, once a mission is established under operations, one D/A 
could be designated as the lead, depending on current capabilities and response 
time to the scene, but the command staff would remain consistent. 

2. Because every state and territory has its own unique structures, authorities, and 
requirements, this national guidance should be implemented at the regional level, 
and supported through regional planning, training, and exercise programs, such as 
FEMA’s Regional Interagency Steering Committees (RISC). 


Figure 3.2 Example Incident Command/Unifled Command/Operations 
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Activity 1.3; Resource Management 

Observation 1.3.1 Strength: National Guard WMD CSTs were valuable state and 
territory assets during these RDD incidents. 

Analysis: The capabilities of the CST teams that responded to Oregon and Guam were 
well suited to the response, and the teams integrated easily with local capabilities. In 
Oregon, the 102nd CST was on-site within three hours after the detonation. This team 
gave assistance to HAZMAT, Bomb Squad, FBI, and DoE RAP personnel in the 
decontamination line and joined the radiological data collection teams that worked jointly 
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within the FRMAC. In Guam, the 94th CSX was on-site one and a half hours after the 
detonation. This team provided assistance during the first joint site entry with GFD and 
Navy EOD, and conducted a relief in place with the Hawaii National Guard 93rd CSX 
deployed from Honolulu.^ 

The standard operating guidelines for how the CSXs function is well-defined in the 
document, “Weapons of Mass Destruction Civil Support Team Tactics, Techniques, and 
Procedures.”** However, similar to the issues with NIMS described previously, this 
document does not provide scenario-specific guidance or operational-level details, such 
as specific mission examples. 

Recommendations: To improve the ability of CSTs to effectively integrate into WMD 
HAZMAT responses, consider the following: 

] . Integrate CSTs into national and regional planning initiatives to align CSX SOPs 
and tactics, techniques, and procedures (TTPs) with national and regional 
response plans for specific scenarios. Clarify CSX functions in national-level 
doctrine, such as the NRF and the Nuclear/Radioiogical Incident Annex. 

2. Review and consider enhancements to the current CSX equipment caches. For 
example, the 94th CSX in Guam did not have enough radiological detection 
meters or communication equipment to properly carry out its mission. In Portland, 
the 102nd CSX did not have enough meters. 

3. Continue joint training and exercising between CSXs and FBI, EPA, DoE, and 
various HAZMAT teams at all jurisdictional levels. 

Capability 2; EOC Management 

Capability Summary: EOC Management is the capability to provide multi-agency 
coordination for incident management by activating and operating an EOC for a pre-planned or 
no-notice event. EOC Management includes: EOC activation, notification, staffing, and 
deactivation; management, direction, control, and coordination of response and recovery 
activities; coordination of efforts among neighboring governments at each level and among local, 
regional, state, and federal EOCs; coordination of public information and warning; and 
maintenance of the information and communication necessary for coordinating response and 
recovery activities. EOCs may include the National (or Regional) Response Coordination 
Centers (NRCC or RRCC), JFOs, National Operations Center (NOC), Joint Operations Centers 
(JOCs), Multi-Agency Coordination Centers (MACCs), and Interim Operating Facilities (lOFs). 

During X4, EOCs and ECCs activated at all levels of the government to deploy assets, coordinate 
the response, and share information. At the local, state, and territory levels, EOCs and ECCs 
activated in response to the explosions. At the federal level, agencies such as DHS, DoS, the 
FBI, HHS, DoE, and the EPA stood up their headquarters operations centers along with NGOs, 


^ Thu CST in Guam could have been available for follow-on radiological data collection during the law 
enforcement incident investigation and preliminary recovery operations. l-[owe%^er, they had completed their T4 
objectives, and concluded their participation the morning of the second day (before the other federal agencies 
arrived). For more on this issue, see the exercise artificialities in the exercise design section. 

^ FM 3-1 1 .22, Department of the Army Headquarters, June 2003. 
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such as the ARC, and private sector entities, such as the Business Operations Center (BOC) in 
Arizona. Later in the response, lOFs and JFOs were established in the venues to coordinate 
federal support to state and local responders. 

The observations discussed under this capability focus on response management, direction, and 
control (including decision making), the coordination of response activities ajiiong all levels of 
govemment, and information sharing. For example, there were new teams and tools introduced 
during the exercise, which were intended to improve information sharing, but D/As at all levels 
of government still had difficulty obtaining accurate and consistent critical information. The 
federal interagency battle rhythm was overly demanding throughout the exercise, which 
contributed to these information management challenges. Radiological data collection and 
distribution of IMA AC products was well coordinated, but key decision making nodes were not 
always well coordinated or well integrated into a unified coordination and management structure. 
This delayed decision making and made it difficult to develop clear public messages. In addition, 
the requirements for LD/HD assets were stressed. 


The table below provides a summary of the observations described under this capability along 
with associated recommendations, where applicable. 

Table 3,2 Summary of EOC Management Observations 


Observation 


Activity 2.1: Catber and provide information 


Recommendation 


2.1,1 Strength: New teams and tools designed to improve coordination, information sharing, 
and real-time planning, were tested at all levels of govemment. 


2.1.2 Area for Improvement: D/As at all 
levels of government, as well as international 
participants, had difficulty obtaining critical 
information and maintaining situational 
awareness. 


Continue to develop and test situational 
awareness tools and supporting processes and 
procedures. Focus first on the most critical 
pieces of infomration desired by leadership. 


2.1.3 Strength: Radiological deposition data collection and management in Oregon was well 
coordinated. 


2.1.4 Strength: IMAAC provided consequence predictions to agencies and officials in all 
three venues and the federal interagency, and there were no conflicting plume models as was 
observed during T2. 


Activity 2.2: Prioritize and Provide Resources 


2.2. 1 Area for Improvement: The exercise 
was designed to stress the requirements for 
LD/HD assets like the FRMAC, the 
Domestic Emergency Support Team 
(DEST), and other protection assets. 


Incorporate more details in the national family 
of plans on the allocation of specific LD/HD 
response and protection assets that could be 
required to respond to multiple incidents. 
Identify assets that can partially replicate 
LD/HD capabilities, and consider alternative 
means to augment these capabilities. 


Activity 2.3; Support and Coordinate Response 
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Table 3.2 Summary of EQC Management Observations 


Obser>'ation 

Recommendation 

2,3.1 Area for Improvement: The federal 
interagency operational cycle was overly 
demanding throughout the exercise. 

Establish a framework for the federal 
interagency operational cycle that can be 
adapted during times of emergency 

2.3.2 Area for Improvement: The purpose, 
definitions, and consequences of HSAS 
threat levels are not clear. 

Review and clarify policy sun'ounding the 

HSAS. Clarify the purpose of the HSAS, its 
link to threat infonnation, and its intended 
consequences. 

2.3.3 Strength: There was effective coordination between DoE and EPA field teams and 
officials that deployed to Guam and Oregon. 

2.3.4 Area for Improvement: There were 
significant challenges in Oregon regarding 
implementation of an effective unified 
coordination structure that linked all 
coordination nodes and addressed the 
complexities of the event. 

Develop concepts and mechanisms within the 
national family of plans to facilitate a “unified 
management of the federal response.” Clarify 
the relationship between ESF-10 and the 
Nuclear/Radiological Incident Annex in the 
NRF. Develop national-level guidance on how 
best to integrate the FRMAC into the overall 
coordination structure. 

2.3.5 Area for Improvement: Some 
agencies had difficulty integrating their 

Senior Federal Officials (SFOs) into the .IFO 

t) 

structure. 

Review and clarify the roles and 
responsibilities of SFOs in the policies, 
procedures, and training that ,support the .IFO. 

2.3.6 Strength: The participation by private 
sector and Critical Infrastructure/Key 
Resources (CI/KR) organizations was the 
largest of any national-level exercise to date. 

Continue to institutionalize and formalize 
relationships between government, private 
.sector, non-government, and CI/KR 
organizations. 

2.3.7 Area for Improvement: The 
mechanisms for private sector and NGO 
integration into emergency response 
structures are not clear. 

Clarify private sector and NGO partnerships in 
policies and the national family of plans. 
Articulate and institutionalize a process for 
private sector and NGO engagement in 
national-level exercises. 

2.3.8 Strength: Disability and other special 
needs play was a major focus area in the 
exercise design. 

Continue to incorporate and expand special 
needs play within national-level exercises. 

2.3.9 Strength: Foreign consular involvement and consular operations were successfully 
exercised. 

2.3.10 Area for Improvement: The 

procedures for accepting cash donations and 
diplomatically critical donations through the 
Internationa! Assistance System (IAS) are 
unclear. 

Claiify the relationship of the IAS Concept of 
Operations (CONORS) and the procedures for 
accepting both diplomatically critical and cash 
donations. 


*■’ The new NRF released after the exercise shortened this tenn to Senior Official (SO) to he inclusive of state, 
Lerritorial, tribal, iuid local officials. 
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Activity 2.1; Gather and Provide Information 

Observation 2.1.1 Strength: New teams and tools designed to improve coordination, 
information sharing, and real-time planning, were introduced at all levels of goveniment. For 
example, DHS posted the National Situation Report (SITREP), Interagency Modeling and 
Atmospheric Assessment Center (IMAAC) plots, and other event information to the HSIN 
COP portal for other D/As to access. This information sharing tool was not available during 
Hurricane Katrina and previous TOPOFF exercises. 

Analysis: DHS and other agencies have been working to address information sharing 
shortfalls that occuiTed during the response to Hurricane Katrina. Similar problems were 
also observed in previous TOPOFF exercises. T4 provided an opportunity to rigorously 
test these improvements. As discussed below, further improvement is necessary to 
support and maintain situational awareness among agencies. Nonetheless, these entities 
and tools did not exist previously, and are a step in the process of addressing this issue. 

The DHS CAT stood up in the NOC to monitor and consolidate information into National 
SITREPs and to conduct real-time planning. The NOC components, including the NRCC 
and National Infrastructure Coordinating Center (NICC), also activated and supported the 
development of the National SITREP. HSIN and the new COP portal were used to 
provide situational awareness to the federal interagency. T4 provided an opportunity to 
test new processes and procedures for maintaining HSIN and the COP. The COP was 
used primarily to display information about the events and to produce and disseminate 
the National SITREP. It provided a readily accessible source for many agencies to read or 
download the SITREP, obtain copies of IMAAC consequence predictions, and access 
basic information about the events. Other portals within HSIN served as repositories for 
additional event documentation. 

Similar tools were used and tested at other federal agencies as well as at the state, 
teiTitory, and local levels. For example, DoS used a web-based crisis management portal, 
which provided key information and reference materials to DoS personnel. The FBI 
operated four Law Enforcement Online Virtual Command Centers (VCCs), which 
allowed for transmission of sensitive but unclassified information between the 
participating FBI field offices and territorial authorities in Guam. HHS used WebEOC, to 
which it has been adding functionality and capability. Portland used WebEOC to share 
information with other local and federal agencies, and Guam used DisasterLAN to share 
information with other federal and territory agencies. 

Observation 2.1.2 Area for Improvement: D/As at all levels of government had 
difficulty obtaining critical information and maintaining situational awareness. Although the 
HSIN and COP provided easy access to some information, other information was not readily 
available. Senior decision-makers were most interested in IMAAC model results, casualty 
counts, infonnation on protective actions, and the status of federal resources. With the 
exception of the IMAAC model results, this infonnation was among the most difficult for 
DHS to collect. 
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Analysis: Table 3.3 shows the draft Critical Information Requirements (CIRs) defined 
as part of the RDD Strategic Plan. As shown, these CIRs fall into two basic categories: 
information that originates at the local level and information that originates at the federal 
level. In some cases, information originates at both levels. 


Table 3,3 RDD Critical Information Requirements 


CIR 

Local 

! Federal 

Primary Source 

*Initial/Updated Assessments 

X 


State/Local EOCs 

Initial/Updated Hazard Data Products 


X 

IMAAC 

Protective Actions Taken or Suggested 

X 

X 

Multiple State/Local /Federal 

Law Enforcement Activities/Actions 

X 

X 

Multiple, compiled by LNO 

Threat Assessments 


X 

Multiple, compiled by LNO 

Transportation Com dors Affected 

X 

X 

NICC 

Infrastructure Damage Assessment 

X 


Nice 

Status of First Responders 

X 


State/Local EOCs 

*Contamination Control Centers/Lines 

X 


State/Local EOCs 

COOP/COG Issues (Federal, Stale, Local) 

X 

X 

Multiple State/Local/Federal 

^Status of Federal Capabilities and Resources 


X 

Multiple Federal 

Recommended Location of JFO 


X 

. FEMA 

Status of Search and Rescue Operations 

X 


Not defined 

Status of Fire Suppression Operations 

X 


1 Not defined 

Evacuation Routes 

X 


Multiple Stale/Local/Federal 

Status of Local Medical Communities 

X 


1 Not defined 

Medical Resources Deployed 


X 

1 Not defined 

Nuclear Incident Response Team Assets Deployed 


X 

, DoE, FEMA 

Red Cross Housing Centers 


X 

ARC 

International Impacts 


X 

! DoS 


The CAT assumed the role of collecting these CIRs and incorporating them into various 
products and tools, such as the National SITREP, HSIN/COP, and briefings. As 
components of the NOC, the NRCC and NICC play a primary role in collecting the CIRs 
and other information defined in the National SITREP. The timeliness and accuracy of 
this information varied. CIRs noted with an asterisk (*) were the most problematic. Often 
these same CIRs were also of the most interest to senior leadership and decision makers. 

Information originating at the local level is collected from a variety of sources. Initially, 
the NOC contacts state and local EOCs or obtains information via the RRCC and NRCC. 
Once the JFO stands up, it becomes the primary conduit for this information. Figure 3.3 
tracks one example of local information — the number of casualties reported in Guam. 

In Guam, initial reports of casualties were ranges: 50 to 100 and 75 to 100. The final 
number of casualties reported at the local level was S2. Although this number was 
reported as early as the evening of October 15, it never appeared in the National SITREP, 
which continued to report the range of 75 to 1 00, and then settled on 75. Note that DHS 


These CIR.S were drawn frcini a briefing piesented daring CAT training, and repiesent a draft .set of CTRs that were 
presented to the group. Some CIRs were not yet fiilly defined, mid did not include information on the source. 
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field elements, including the DHS Situational Awareness Team (DSAT) and the Principal 
Federal Official (PFO), had information reporting 82 and 83 casualties, respectively. 

Figure 3.3 Guam Casualties 
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The CAT worked to provide exact numbers of casualties, injuries, and fatalitie.s. 

However, reporting the range of 75 to 100 casualties was not incorrect since the actual 
number fell within this range. One main reason for collecting information on casualties is 
that it is an indicator of the need for federal support. As such, it is the magnitude of the 
number that matters, and the difference between 75 and 82 is not significant. However, 
the initial misreporting of 5,200 casualties by HHS, reported at 6:35 p.m. EDT on 
October 15 in the Secretary’s Operation Center (SOC) (their interpretation of the spoken 
“50 to 100”) was significant. This misreport was quickly coirected (shown in Figure 3.3). 

Reports of casualties are also problematic because the terms reported often vary. 
Casualties typically include all injuries and fatalities. Sometimes, just injuries are 
reported, and these may be broken down by their severity or whether or not they were 
hospitalized. Reports of fatalities were generally more consistent than reports of injuries 
and casualties. Other information originating locally often varied in consistency and 
included numbers of persons evacuated, sheltering in place, or decontaminated, as well as 
the locations of evacuation and shelter- in-place areas. 

Information originating at the federal level that was of interest to senior leaders and 
decision makers included IMAAC model results, threat assessments, and the types of 
federal capabilities at the scene. In general, information with a designated federal source 
was readily available. One example is the IMAAC models. CAT members could 
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download these products directly from HSIN or the IMAAC website and include them in 
the SITREP. 

Inforaiation requiring the consolidation of data from multiple agencies was the most 
difficult to obtain. Examples include federal assets on scene, referred to as “blue forces” 
on HSIN/COP, and the protective measures being taken by federal agencies in response 
to HSAS levels. The CAT sent out requests for information (RFIs) for these CIRs on 
multiple occasions during the exercise, but received little information in response. Within 
the COP portal, the information available under blue forces was incomplete. 

HSIN and the COP portal are relatively new tools that are not yet fully developed. Many 
users lacked experience and training on the tools. In the NRCC, a critical node for 
collecting and posting much of the information on HSIN, much of the staff spent the 
early part of the exercise gaining familiarity with the system which delayed other actions 
like future planning. Technical issues contributed to problems with gathering and 
displaying information. The terrorism SITREP could not be generated directly within the 
COP portal at the time of the exercise, although this upgrade is planned. During the 
exercise, staff had to cut and paste information from COP and other sources into a 
separate document, which added time to the development of the National SITREP and 
left less time for review and editing. These technical issues have been documented by the 
DHS Office of Operations Coordination and connective actions are being implemented. 

Although information accuracy and timeliness varied for the CIRs, a great deal of 
information was available on HSIN that was not available during previous TOPOFFs or 
Hun'icane Katrina. Still, many agencies complained that they did not have situational 
awareness and that it was too hard to find information on HSIN. HSIN contains many 
different portals, and often different information was available in each. Agencies had to 
monitor these multiple portals in addition to their own systems and there was not a single 
comprehensive source for incident inforaiation. The most substantive source of 
infonnation on HSIN/COP was the National SITREP. This document was often close to 
30 pages in length, and information about the CIRs was sometimes located within the 
extensive ESF reports or other sections, requiring the reader to review the entire 
document in search of particular pieces of information. Although there is an Executive 
Summary, the HSC and other users were not satisfied with its content. ' ' 

As it was for many agencies, information overload was an issue for the CAT, which had 
to mine various e-mail inboxes and HSIN sites for infonnation to include in the SITREP 
and in the COP. Observation 3.1.2 in the Public Information and Warning capability 
provides a more detailed account of information overload experienced by PIOs. 

Recommendations: Continue to develop and test situational awareness tools and 
supporting processes and procedures. The DHS Office of Operations Coordination is 
already taking action on a lengthy list of recommendations derived from internal AARs 
which focused on many of the issues raised above. In addition: 


Hointjland Security Council T4 Lessons Learned, DHS Action Items, November 9, 2007, 
'■ DHS/OPS T4 Corrective Action Prioritization Tool. December 13, 2007. 
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1 . Work with the federal interagency through the existing HSIN working group to 
further develop the requirements for situational awareness and the federal COP. 
Consider focusing first on the few key elements of information that were of 
primary interest to decision makers and then developing the processes and 
procedures for collecting, validating, and displaying this information. Consider 
graphical displays or other ways to make information easier to find and 
understand. 

2 . Consider reporting numbers as ranges, rather than point estimates, during the first 
48 to 72 hours of a response. 

ObSBfVation 2.1.3 Strength: Radiological deposition data collection and management in 
Oregon was well coordinated.'^ 

Analysis: Prior to the arrival of federal assets in Oregon, radiological data collection was 
managed by PFR HAZMAT. Data collected were sent to IMAAC and the National Nuclear 
Security Administration (NNSA) Consequence Management Home Tetnn set up for the 
Oregon incident {CMBT/OR)'"* and used to refine the preliminaiy plume model results. EPA 
responded under statutory authority of the National Oil and Hazardous Substances Pollution 
Contingency Plan after the EPA Region X Emergency Operating Center (REOC) observed 
reports of the explosion on VNN. DoE RAP Region 8 was activated by NNSA and was 
contacted en route by PFR HAZMAT and EPA. Upon arrival, DoE and EPA coordinated 
with PFR HAZMAT, as well as the 102nd WMD CST and tlie Oregon State Department of 
Human Services Public Health Division RPS ERT, to manage radiological data collection 
at the incident site. 

Upon arrival, the FRMAC took over responsibility for the coordination and management 
of all radiological deposition data collection efforts in accordance with general FRMAC 
operating guidelines and the Nuclear/Radiological Incident Annex. This is shown in red 
in Figure 3.4. All radiological field teams, including PFR HAZMAT, Oregon State RPS 
ERT, 102nd CST, DoE RAP teams, EPA National Counter-Ten'orism Response Team 
(NCERT), EPA Radiological Emergency Response Team (RERT), EPA National 
Decontamination Team (NDT), EPA Environmental Response Team, and USCG Pacific 
Strike Team, were fully integrated into the FRMAC structure and tasked for data 
collection missions by FRMAC leadership. Data collected at the incident site and data 
collected to characterize the radiological footprint were sent to the FRMAC. The 
FRMAC continued to share radiological data with IMAAC and the CMHT/OR to further 
refine the deposition models. 

This represents significant improvement over what was observed during T2, where 
deposition data collection efforts were haphazard and data management was 
uncoordinated and decentralized. 


Radiological data collection efforts were notional in Arizona, In Guam, data was collected on the first day of the 
exercise, but was notional once DoE and EPA arrived, 

CMHTs provide logistical .support, develop initial effects predictions and assessments, and provide expert advice 
to field teams. 
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Figure 3.4. Radiological Data Collection and Product Distribution in Oregon 



Observation 2.1.4 Strength: IMAAC provided consequence predictions to agencies and 
officials in all three venues and the federal interagency, and there were no issues with 
conflicting plume models as was observed during T2. 

Analysis: Processes established after T2 to minimize differences in plume model 
outputs and provide one source for consequence predictions appeared to be effective. The 
product distribution process for Oregon is also shown in Figure 3.4. An IMAAC 
consequence prediction was requested by PFR HAZMAT soon after the initial explosion. 
Radiological deposition data were collected and shai'ed with IMAAC and the CMHT/OR 
to further refine the model results. Once products were approved, they were posted to the 
IMAAC website and on HSIN in accordance with IMAAC SOPs. There were also regular 
conference calls hosted by IMAAC and the CMHT/OR to discuss radiological data 
collection strategies, product development, and interpretations and assessments. 

Upon arrival, the FRMAC continued to coordinate with IMAAC and the CMHT/OR to 
further refine the deposition models. Once enough radiological data was collected, the 
FRMAC produced a deposition data product, which depicted the actual radiological 
deposition footprint. The FRMAC deposition data product was also available on the 
IMAAC website and posted on HSIN. 

While data collection and management was partially simulated in Arizona and Guam, 
there was still coordination between the venues, IMAAC, and CMHTs set up for the 
Arizona and Guam incidents, respectively. IMAAC consequence predictions were 
requested soon after the explosions in Guam and Arizona, and IMAAC modeling and 
data products were distributed in the same manner as in Oregon. 
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Activity 2.2: Prioritize and Provide Resources 

Observation 2.2,1 Area for Improvement: The exercise stressed the requirements for 

LD/HD assets like the FRMAC, the DEST, and other protection assets. Limited availability 
of first'! i lie assets like the FRMAC was addressed by using assets from other agencies. 
However, because much of the outcomes were pre-scripted and notionalized in the exercise 
(the FRMAC was scripted to go to 
Oregon, no products were developed in 
Guam and Arizona using deposition data), 
it is unclear whether the gaps were 
adequately filled. Plans for deploying 
protection assets, such as DoE search 
teams and DHS Visual Intermodal 
Protection and Response (VIPR) teams 
were developed by the CAT in response to 
taskings that arose in senior leadership 
meetings. Although decisions were made 
and actions taken, there was no formal 
process for adjudicating competing needs 
for LD/HD assets. 



Analysis: T4 stressed the requirements for LD/HD assets like the FRMAC, the DEST, 
and other protection assets. 

FRMAC. Table 3.4 shows how FRMAC-Iike capabilities were assembled in Guam using 
available radiological response assets. 


Table 3.4 FRMAC Capabilities Replicated in Guam 


Capability 

FRMAC 

Used in Guam 

Monitoring 

Field monitoring 

Local HAZMAT, CST, DoE 

RAP (notional), EPA 

Monitoring 

Aerial Measuring System 
(AMS) 

DoD (notional) 

Assessment 

Dose assessment 

DoE and EPA officials 

Assessment 

GIS 

No indication that Guam had 

GIS capability 

Assessment 

Data management 

CMHT 

Assessment 

Modeling and deposition 
data products 

IMAAC, CMHT (modeling 
only) 

Health and Safety 

Medical (REAC/TS) 

Accessed by phone 

Health and Safety 

Safety 

Guam and federal OSHA 

Laboratory 

Laboratory analysis 

No laboratory analysis available 


Since Arizona field activities were all notional, no meaningful comparison can be made. 
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The FRMAC capabilities are separated into the four primary response categories of 
monitoring, assessment, health and safety, and laboratory analysis:'^ 

• Monitoring. Guam HAZMAT, the 93rd and 94th National Guard WMD CSTs, 
and notional DoE RAP teams and EPA field teams fulfilled monitoring 
responsibilities during the exercise, although on a much smaller scale than the 
FRMAC. In addition, DoD notionally provided aerial monitoring before DoE and 
EPA arrived. 

• Assessment. Assessment consists of several functions, including data 
management. Geographic Information System (CIS) modeling, and the provision 
of subject matter expertise. DoE and EPA senior officials provided dose 
assessment and interpreted IMAAC products for decision makers in Guam. 
Additional support was available via the Guam CMHT. The Guam CMHT also 
fulfilled data management responsibilities (although these activities were mostly 
notional). IMAAC, as discussed earlier, in coordination with the Guam CMHT, 
provided modeling capability.'^ Finally, Guam did not use any GIS assets during 
the exercise, and this capability did not appear to be available within the local 
government. 

• Health and safety. DoE and EPA officials in Guam were in telephone contact 
with Radiation Emergency Assistance Cenler/Training Site (REAC/TS) 
personnel, who provide treatment and medical consultation for injuries resulting 
from radiation exposure. Guam OSHA and federal OSHA were also present to 
monitor safety concerns. 

• Laboratory analysis. This function went unfulfilled in Guam, and it was 
recognized as a significant shortfall during the exercise. 

The response in Guam was able to replicate some of the FRMAC capabilities, but there 
clearly would have been shortfalls in areal-world response to multiple incidents. 

Potential additional sources for FRMAC capabilities are shown in Table 3.5. 


Table 3.5 Additional Sources for FRMAC Capabilities 


Capability 

FRMAC 

Potential Additional Sources 

Monitoring 

Field monitoring 

DoD, international 

Monitoring 

Aerial Measuring System 
(AMS) 


Assessment 

Dose assessment 


Assessment 

GlS 

DoD, private sector 

Assessment 

Data management 


Assessment 

Modeling and deposition 
data products 

CMHT (modeling and data 
products) 

Health and Safety 

Medical (REAC/TS) 


Health and Safety 

Safety 


Laboratory 

Laboratory analysis 

International 


Nati(ina) Nuclctir Security Administration, FRMAC Operations Manual, December 2005. 

As discussed earlier, due to exercise constraints, IMAAC and CMHT only provided plume modeling products 
during the exercise. No attempt was made to generate data products based solely on deposition data. 
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They include: 

• Monitoring, DoD assets could be requested, and international support could 
augment this function in ai'eas that are a significant distance away from the U.S. 
mainland. 

• Assessment. Providing GIS capability presents a challenge, but it is plausible that 
this function could be obtained from DoD or the private sector. The CMHT has 
the capability to provide FRM AC-like data products based on deposition data. 
Another potential solution is not to deploy the early-phase assessment functions. 
Leaving some capabilities to be conducted by the CMHT, and not forward 
deployed, would enable those capabilities to be available for other incidents in the 
event of multiple events. 

• Laboratory analysis. Several ideas were suggested during the exercise to provide 
this capability, including putting together an EPA mobile lab and/or arranging for 
international support. 

DEST.^* The DEST is an interagency on-call team of ten'orism experts who provide 
support to the FBI Special Agent in Charge (SAC) during domestic WMD terrorist 
threats or incidents. 

During T4, the DEST deployed to Oregon in real time. The DEST mobilized one hour 
after the explosion in Oregon and departed for Oregon within four hours. Upon arrival in 
Portland, the DEST experts integrated into the FBI JOC. DEST personnel coordinated 
with their own agency response elements on scene to provide information flow to and 
from the FBI SAC/JOC, which is in accordance with DEST procedures,’^ In addition, 
DEST personnel worked with their own agency counterparts on scene to transition 
support to the JFO after the JOC ended operations.” 

There were limited discussions in senior leadership meetings about deploying the DEST 
to any of the incident sites. Soon after the explosion in Guam, a decision was made to put 
the DEST on standby rather than deploy it to Guam. However, no formal decision was 
made to deploy the DEST the following day after the explosion in Oregon and Arizona.^^ 
FBI controllers suggested that senior leadership did not have enough familiarity with the 
capabilities of the DEST to support decision-making regarding activation and allocation. 

Protection assets. Several types of protection assets were employed during the exercise: 

• The DHS CAT Planning Section developed a search plan using DoE teams, which 
were notionally deployed on October 17. 

• The DHS CAT Planning Section also developed a VIPR plan to provide security 
and visual deterrence at Cl sites in four cities. It was developed overnight on 
October 1 8, but the exercise ended before these teams were notionally deployed. 


This observation was drawn from FBI input into the AAR process. 

Due to the artificial nature of the deployment some DEST personnel were undemtilized in Oregon. 

The FB I JOC ceased operations when the law enforcement phase of the exercise concluded, which was an 
exercise aitificiality. 

The deployment of the DEST to Oregon was pre-scripted, and the asset deployed despite the fact that senior 
leaders at the deputy and principtil level never formally decided to deploy the DEST. 
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• DHS proposed Immigration and Customs Enforcement (ICE) support to FBI to 

enact a “round up” plan to aiTCst and question persons with possible links to 

terrorism. 

These actions were driven by discussion and decisions in senior leadership meetings, and 
were unanticipated by some of the players that were called on to develop deployment and 
other plans to support the decisions. The draft RDD Strategic Plan, which many DHS 
players used as a road map for the response, does not currently address protection 
activities. Plans for deploying protection assets were developed by the CAT in response 
to taskings that arose in senior leadership meetings. Some meeting participants were 
unfamiliar with the CAT and were surprised to see it play an active role in developing 
protection plans. 

SOs participating in the Principals SVTC felt that there was an unnecessary delay in 
deploying these protection assets. Although decisions were made, there was no formal 
process for adjudicating competing needs and making and disseminating decision 
outcomes (see related observation 2.3.1). In addition, decisions and actions were not well 
linked with exercise intelligence. For example, the cities selected for VIPR deployment 
were not based on exercise intelligence, although this could have been an ^irtificiality of 
the exercise. 

Recommendations: Decisions regarding scarce resources should be incorporated into 
scenario-based plans. The DHS Office of Operations Coordination is already 
implementing corrective actions raised by the HSC and its own after-action process that 
address some of these recommendations: 

1. DHS, in coordination with the federal interagency, should incorporate 
contingency plans for multiple RDD/IND incidents into the Strategic Plans 
and identify assets that can partially replicate LD/HD capabilities. In addition, 
the HSC called for a database of radiological assets to be developed. 

2. DoE and EPA should investigate the cost/benefit of NOT deploying the early 
phase assessment functions of the FRMAC to an incident site. In addition, 

DoE and EPA, in coordination with DHS, DoD, and DoS, should explore 
options to bolster monitoring and laboratory capabilities through Memoranda 
of Understanding (MOU) or pre-scripted mission assignments with DoD and 
foreign countries that are closer to U.S. states and temtories. 

3. DHS, in coordination with the federal interagency, should account for 
protection assets and capabilities in the national family of plans, including the 
RDD Strategic Plan, NRF, and the Nuclear/Radiological Incident Annex. 

4. DHS, in coordination with the federal interagency, should clarify agency roles 
and responsibilities regarding protection assets, as well as the role of CAT in 
developing deployment plans. 

5. DHS, in coordination with the federal interagency, should develop a training 
package and decision matrices for senior leadership describing the capabilities 


There have been past efl'ort.s to develop similar databases, siteh a.S the Response Resource Inventory Sy.stem. 
Efforts to develop a new database of radiological asseLs shotild begin with this aird other existing databa.ses. 
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and deployment of existing radiological response assets, including the DEST, 
and protection assets. 

Activity 2.3: Support and Coordinate Response 

Observation 2,3.1 Area for Improvement: The federal interagency operational cycle 
(often termed battle rhythm) was overly demanding throughout the exercise. Senior 
leadership meetings, such as the Domestic Readiness Group (DRG) and Counterterrorism 
Security Group (CSG), coupled with SITREP deadlines and press briefings, created an 
unrealistic workload for interagency operations center staff such as the DHS CAT and the 
HHS Emergency Management Group (EMG). In addition, formal summaries were not 
distributed from these meetings, requiring staffs to rely on informal back-briefs from 
participants. Both of these problems contributed to inaccuracies and inconsistencies in the 
information conveyed in products such as situation reports and leadership briefs (discussed in 
2.1.2), 


Analysis: Figure 3.5 shows the main components of the operational cycle. Senior 
leadership meetings are shown along the top and include the HSC/NSC principals 
meetings along with the CSG and DRG. Although this schedule was pre-set for the 
exercise, it is thought to be similar to what would occur during an actual emergency. 

Figure 3.5 T4 Operational Cycle 
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DHS-hosted meetings are shown in the middle of the figure. The Senior Leadership 
Group (SLG) was a conference call hosted by the NOC and included the DHS 
components and the PFOs and Federal Coordinating Officials (FCOs). The FEMA Video 
Teleconferences (VTCs) are operationaLlevel calls hosted by the NRCC that include ESF 
partners and FEMA field components. Other agencies, like HHS and EPA, hosted their 
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own operational-level calls with their components and field teams. National SITREP 
reporting deadlines are shown along the bottom. 

As shown in Table 3.6, there was considerable overlap in the topics discussed at all of the 
senior leadership meetings. Documentation of meeting participation was not available; 
however, it was reported to the evaluation team that there is little overlap in the 
membership of these groups. 


Table 3.6 Topics Discussed in Senior Leadership Meetings 



Principals SVTC 


CSG 


DRG 


DHS SLG 

• 

Intelligence and law 

• 

Intelligence and 

1 

• 

Intelligence and 

• 

Intelligence and 


enforcement 


law enforcement 


law enforcement 


law enforcement 

• 

Situation updates 

• 

Intelligence sharing 

• 

Situation updates 

• 

Situation updates 

• 

HSAS 

m 

Situation updates 

• 

HSAS 

• 

HSAS 

# 

Continuity of 

m 

HSAS 

• 

COGCON 

m 

COGCON 


Government 

m 

COGCON 

m 

Federal resource 

• 

Federal resource 


Readiness 

• 

Federal resource 


allocation 


allocation 


Conditions 


allocation 

m 

Protection 

• 

Protection 


(COGCON) 

• 

Protection activities 


activities 


activities 

m 

Federal resource 

• 

International issues 



• 

Declarations 


allocation 







• 

Protection activities 







• 

International issues 








Prior to meetings, staffs needed to provide updates and products to leadership, such as 
agendas, talking points, and briefings. With back-to-back meetings on October 16, the 
demand for updates was continuous and consumed a large part of staff time. Within the 
CAT, the development of senior leadership products was not well-integrated with 
National SITREP development. Because of the schedule, these products had to be 
developed in parallel by different .staff members. This led to some inconsistencies in 
infonnation reported in meetings and included in the National SITREP. 

During meetings, there was no formal process for adjudicating competing needs and 
courses of actions. Although the CAT had a process for developing courses of action and 
did so for a few decisions, such as HSAS level changes, this process was only used to 
support making recommendations for DHS leadership to consider in preparation for 
senior leadership meetings. 

Following senior leadership meetings, summaries were not formally disseminated.^'^ 
Instead, meeting outcomes were informally briefed back to agencies by their participants. 
This led to several instances where paiticipants left meetings with different 
understandings of decisions: 

• At several senior leader meetings on October 15 and 16, changes in HSAS were 
discussed. The first decision announced at the October 1 5 SLG was to change the 
HSAS to Red in Guam. Several times after these decisions, players were not sure if 


This was an issue in previous TOPOFF exercises. 
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Red was for all of Guam or the Port of Guam, and it was reported both ways. At this 
meeting and in meetings the next morning, the decision to go to Orange nationwide 
was made, but the announcement was delayed until the next morning so that DHS 
could gather infonnation on protective actions. This resulted in two different 
interpretations of the decision; 

1 . The HSAS is not at Orange; the level will increase to Orange tomorrow and 
will be announced to the public. 

2. The HSAS is at Orange and D/As should pursue activities that are required by 
the change; the change will be announced to the public tomorrow when D/As 
are ready. 

• After the Principals SVTC at 1 ;00 p.m. on October 1 6, some agencies thought it was 
decided that the DEST would not deploy. At the 3:30 p.m. CSG later that day, they 
were surprised to find that the DEST was making preparations to deploy. 

• Following the same Principals SVTC on October 16, some participants thought that 
the White House had ordered a change to COGCON level two. This change was 
announced at the 2:30 p.m. SLG and formally communicated by the NOC to other 
agencies at about 4:30 p.m. that same day. Shortly thereafter, the NOC found the 
order to be erroneous and made another notification at 5:45 p.m. restoring the 
COGCON level to four. 

Updated information not available on HSIN or within the CAT was occasionally briefed 
in senior leadership meetings. With no formal meeting summaiies, this information was 
not passed on to the CAT. An example of this is casualty numbers and is described earlier 
under observation 2.1.2. 

Recommendations: Establish a framework for the federal interagency battle rhythm 
that can be adapted during times of emergency. The DHS Office of Operations 
Coordination is already implementing coiTective actions raised by the HSC and its own 
after-action process that address some of these recommendations: 

1 . Convene an interagency working group to share infonnation on internal agency 
meeting and reporting schedules. This information can help the federal 
interagency align reporting and meeting schedules and facilitate development of 
the National SITREP. 

2. Review the pui^pose, audience, and scope of various senior leadership meetings 
and deconflict them. 

3. Include policies and procedures for formally disseminating meeting summaries 
that include key information, decisions, and taskings. 

Observation 2.3.2 Area for Improvement: The purpose, definitions, and consequences 
of HSAS threat levels remain unclear. As observed in past TOPOFF exercises, T4 players at 
all levels of government, as well as international players, raised questions about the meaning 
and implications of HSAS level changes. In addition, state and territory agencies set their 
own threat levels that differed at times from the HSAS level. Interpretation of Red in Guam, 
Portland, and Phoenix, as well as the change to Orange nationwide, raised the most 
questions. Sector-specific changes were clearer and resulted in specific protective measures. 


Section 3: Analysis of Capabilities 4^ U.S. Department ot Homeland Security 


For Ott i c ial Use Only 


For Offic i a l Us e Only 

National Exercise Program (NEP) 


After-Actfon Report / 

Improvement Plan (AAR/IP) Top Officials 4 (TOPOFF 4) 


Analysis: Figure 3.6 compares HSAS level changes with state, territory, and local threat 
level changes. 

The first HSAS level change was a change to Red in Guam shortly after the explosion on 
the island. The reasoning for this change was described in several ways: 

• In e-mails, DHS stated, “raising the threat level to Red will provide first 
responders and local officials with the ability they need to carry out enhanced 
security measures and undertake rescue and recovery operations.” 

• In a senior leadership meeting, it was stated that “Red allows the responders to 
move, but not the terrorists.” 

• In an interview with VNN, the DHS secretary was asked if the change to Red had 
shut down the island. He responded that it had, and that it was intended to help 
reduce the danger of contamination. 

Figure 3.6 Timeline of HSAS and State/Territorial Threat Level Changes 
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Guam enacted its own “modified Red” shortly after the HSAS change. The reasoning 
given to a mock media representative was to “allow emergency response vehicles to 
move in and out of the incident site,” Yet, the intention of DHS was not to impact first 
responder movement. Several times during the exercise, reports of Guam’s “modified 
Red” were mistaken for the DHS HSAS level. 

After the explosion in Oregon, the DHS secretary appeared on VNN again and discussed 
the HSAS level change to Red in Portland. He said that he had confen'ed with the Oregon 
governor about raising the HSAS level to Red. Furthennore, he acknowledged the likely 
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economic impacts and said that this was a temporary change designed to limit the ability 
of terrorists to carry out additional attacks in that ai’ea. He asserted that it gave first 
responders the authority and freedom of movement to carry out their response. Later in 
the day, several county command centers recorded Portland’s alert level as Red to match 
the HSAS level. In addition, several hours after DHS changed the HSAS level to Orange 
for specific sectors nationwide, Oregon raised its state-wide level to Orange as well, 
according to the State ECC. However, the Oregon governor reported at 7:21 p.ni. EDT on 
VNN that the state threat level was Orange with no mention of Portland. This 
discrepancy may have been caused by the coordination challenges discussed later under 
observation 2.3.4. 

Arizona raised the entire state to Red shortly after the explosion, while the HSAS was 
Red only for Phoenix. The Arizona governor appeared on VNN at 4:38 p.m. EST on 
October 17, When asked about the investigation surrounding the man who detonated the 
explosion, the Arizona governor said one of the reasons that they were at Red was 
because the suspect (or an accomplice) had not yet been apprehended. Further, the 
explosion was actually at the intersection of Routes 101 and 202, which is outside of the 
City of Phoenix. Although this area is considered to be part of the greater Phoenix area, it 
was unclear whether the HSAS was red for the greater Phoenix area or just for the city 
itself. 

The sector-specific change to Orange nationwide for borders, pons of entry, 
transportation nodes, and power plants resulted in documented protective actions. U.S. 
Customs and Border Protection (CBP) increased security at the border, TSA increased 
security at airports, and Arizona increased security at a nuclear power plant. On VNN, 
the DHS secretary said that the reason for this change was the potential for future attacks. 
He urged the public to become informed, make preparations for additional attacks, and 
referenced ready.gov as a source of information. He also said that additional security 
measures were being taken at airports, mass transportation nodes, and other Cl sites, and 
advised that governors and local officials take additional measures such as limiting public 
gatherings. Tliere were few recorded closures in response other than canceled college 
classes in Arizona and a few public school closings. 

The impact of the change to Orange nationwide for all sectors is less clear. Although it 
was reported that the DHS secretary was inclined to raise the HSAS to Orange 
nationwide as early as the evening of October 15, this change was delayed until the CAT 
could collect information on what protective measures would go along with the change, 
indicating that check! i,sts and procedures for changing HSAS are still inadequate. The 
CAT encountered significant difficulty collecting this information. It sent out RFls to the 
federal interagency on two occasions and received very little infonnation in return. Once 
the level was raised to Orange nationwide for alt sectors, there was no apparent change in 
the message to the public. 

There are at least two instances when other federal agencies recommended additional 
HSAS changes in senior leadership meetings. Neither recommendation led to a change. 

In one example, TSA requested that DHS increase the transportation threat level to Red 

CBP conducted an inlemal detection exercise in conjunction with T4 and its activities tire described in Annex 2. 
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for specific cities several times on October 16. This recommendation was passed to the 
CAT for analysis, although no results of this analysis were reported. ' The planning 
section of the CAT, made up of members of the Incident Management Planning Team 
(IMPT), was responsible for developing recommended changes in HSAS and considered 
many different HSAS scenarios. One of its major concerns was the economic impact of 
sustained HSAS level changes, and it never recommended any additional elevations to 
Red. There was also one recorded instance supporting this economic concern at the local 
level. On October 18, Phoenix officials said that they would seek reimbursement through 
the federal emergency declaration for “security costs of Red.” 

Recommendations: Review and clarify policy surrounding the HSAS through an 
interagency working group led by DHS. The DHS Office of Operations Coordination is 
already acting on a similar recommendation. 

1 . Clarify the purpose of the HSAS, its link to threat information and other alert 
condition systems like COGCON and Defense Readiness Condition (DEFCON), 
and its intended consequences. 

2. Define the purpose of specific changes in HSAS (e.g., the purpo.se behind raising 
the HSAS to Red at an incident site following an event) and how changes are 
managed. 

3. Compile recommended protective measures linked to different changes in HSAS. 
Include federal, state, local, CI/KR, and the public. This information can be used 
to issue scenario-specific guidance during an event. 

4. Incorporate HSAS level changes in national scenario-based plans. 

Observation 2.3.3 Strength: There was effective coordination between DoE and EPA 
field teams and officials that deployed to Guam and Oregon.^^ 

Analysis: In Guam, DoE was the coordinating agency, in accordance with the 
Nuclear/RadiologicaJ Incident Annex of the NRP. Due to resource constraints, both DoE 
and EPA senior officials recognized that they would need to coordinate their efforts to 
manage the response. At the incident site, DoE and EPA officials worked together to 
fulfill notional nrission assignments and complete radiological deposition data collection 
tasks. 

In Oregon, DoE was also the coordinating agency, in accordance with the 
Nuclear/Radiological Incident Annex of the NRP. DoE and EPA worked together at the 
FRMAC to assign and complete radiological deposition data collection tasks. The EPA 
deputy Radiological Emergency Response Team (RERT) commander was the senior 
EPA representative at the FRMAC. As described above, all radiological field teams were 
fully integrated into the FRMAC structure, including DoE and EPA field teams, and 
tasked by FRMAC leadership. Several officials from DoE and EPA who deployed to 


Thi.s apparent lack of follow-through indicates again that formal processes for decision making (discussed in 
23 . 1 ) and disseminating results are inadequate. 

Since field teams in Arizona were all notional, we did not explore EPA and DoE coordination there. 
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Oregon stated that the coordination between DoE and EPA officials and their respective 
field teams was the best that they had ever observed. 

Observation 2.3.4 Area for Improvement: In Oregon, there was no unified 
coordination structure that linked all components of the response. This issue was observed in 
past TOPOFF exercises and highlighted as a critical challenge during the response to 
Hurricane Katrina. The response to the RDD event in Oregon was complex and involved 
many D/As at the local, state, federal, and international levels with many different 
authorities, functions, and assets. These D/As established multiple decision-making nodes 
with varying degrees of coordination, which did not promote information flow. This lack of 
coordination had a significant impact on top official decision making, especially regarding 
the implementation of protective actions and public messaging. This section focuses on the 
Oregon venue, which established a complete response structure. In Arizona, all field 
components were simulated, and in Guam, some field teams and response functions were 
simulated. In addition, Guam does not have a local level of government, making it less likely 
to experience some of the problems described below. 

Analysis: Figure 3,7 shows the coordination diagram that emerged once federal a.ssets 
aiTived and integrated into the response structure. Solid an'ows indicate integrated 
coordination (e.g., formal mechanism established such as LNO exchange or joint 
planning), while dotted lines indicate limited or intermittent coordination. There were six 
key decision-making nodes: local EOCs/ECCs, state ECC/Agency Operations Centers 
(AOCs), the FRMAC, the incident site unified command, a public health unified 
command, and a JFO. For the most part, these six nodes operated independently of each 
other, and there was no overarching body to unify the response. 


Figure 3.7. Oregon Coordination Diagram 



This figure is based on Lhe reconstruction of exercise infomiation flow among sites. It reflects what actually 
happened during the exercise, rather than what might be depicted in plans and procedures. 
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The following examples illustrate coordination challenges: 

• Lack of strategic direction. Late in the afternoon on October 16, leadership of the 
unified command at the incident site was transitioning from PFR to the FBI as the 
primary mission shifted to law enforcement."* At approximately 9:45 p.m. EDT, there 
was a coordination meeting between DoE, EPA, FRMAC, Oregon State RPS, 
Multnomah County Health Department, and PFR HAZMAT to discuss the status of 
the public health response, formalize a coordination plan, and develop a site 
assessment strategy. This meeting led to the fonnation of a second unified command 
at the Multnomah County Health Department EOC, which was focused on public 
health, long-term protective actions, and recovery issues. However, there was no 
mechanism in place to coordinate activities across both unified commands. Rather, 
they operated independently and communicated infrequently with each other. On the 
second day of the exercise, the incident site unified command decided to focus on 
blast site issues, but for the most pail both unified commands still operated 
independently of each other. Late in the afternoon on October 17, as the FBI was 
approaching the completion of the law enforcement investigation, the decision was 
made to terminate the incident site unified command. Authority over the incident site 
was transferred to the public health unified command that evening. 

Further, there was no evidence that a representative from DHS or the JFO was present 
at either of the unified commands. This is particularly significant since, under the new 
September 2007 version of the Nuclear/Radiological Incident Annex (which must be 
noted was not in effect for the exercise) DHS is designated the coordinating agency 
for an RDD incident and therefore is expected to participate in the unified command. 

• Delayed information sharing and decision making. The Oregon State Department 
of Human Services Public Health Division is the lead agency for radiological 
incidents under Oregon statute. The Oregon State Department of Human Services 
Public Health Difisaan RPS ERT deployed to incident site at approximately 1 ;30 p.m. 
on October 1 6 and coordinated with PFR HAZMAT. An RPS representative 
participated at the coordination meeting discussed above and at the ensuing public 
health unified command. However, the representative was a health physicist, who was 
not authorized to make decisions for the state. Furthermore, it is not evident whether 
protective action recommendations developed at the public health unified command 
and long-term implications were relayed to Oregon state agency leadership and 
decision makers. Surprisingly, the first time that the Oregon governor saw the 
FRMAC deposition data product was when it was shown on VNN on the final day of 
the exercise. 

Although the Portland Office of Emergency Management (OEM) ECC was well 
integrated with the incident site unified command, Portland representatives were not a 
major component of the public health unified command, which limited their access to 
public health expertise and data products. Portland was represented at the initial 
coordination meeting by PFR HAZMAT. After that meeting, there was no 


^ Command and control al the incident site is diseiissed in more detail in section 1.2.1. 
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representation from Portland at the public health unified command until the last day of 
the exercise, when an incident commander from the Portland OEM ECC went to the 
public health unified command. On the same day, the DoE Deputy SEO (a member of 
the public health unified command), a FRMAC scientist, and personnel from the EPA 
RERT went to the Portland OEM ECC to brief the FRMAC data product to the mayor 
of Portland and other city officials. This was the first time that Portland OEM 
leadership saw the FRMAC deposition data products. Furthermore, there is no evidence 
that long-term protective action recommendations were relayed to Portland leadership 
until the morning of October 19. 

Similarly, the JFO and PFO cells did not have ready access to technical expertise and 
data products. As discussed earlier, these products were posted to HSIN, but JFO 
personnel had difficulty downloading information from HSIN. On the last day of the 
exercise, a FRMAC scientist was also sent to the JFO to brief the FRMAC deposition 
data products to JFO leadership. 

• Conflicting public messages. The Oregon Department of Human Services Public 
Health Division issued a press release on October 16 at 7:20 p.ra. EDT, which 
identified shelter-in-place boundaries. This press release was developed 
independently and conhadicted previously released guidance and recommendations 
from the Multnomah County Health Department, Portland OEM, and the mayor of 
Portland. This lack of coordination was particularly surprising gi ven the regular 
conference calls between the mayor of Portland, the Multnomah County 
commissioner, and the Oregon governor. 

In addition, until the morning of October 19, public messages in Oregon were focused 
on short-temi protective actions (e.g., shelter-in-place, immediate health concerns, 
immediate actions people could take). When the FRMAC deposition data product was 
released on October 19 and discussed on VNN by local and federal officials, there 
had not heen any public messages to prepare the public for the possible longer-term 
consequences, such as the contamination of agriculture and dairy products and the 
likely relocation of a significant area within one year. 

Below are some factors that may have contributed to the lack of integration: 

• Participation in the public health unified command may not have been a high priority 
for the City of Portland because the city has no public health agency and relies on 
Multnomah County for public health expertise. Multnomah County Health 
Department deployed a liaison to the Portland OEM ECC. However, the liaison was 
not a radiological SME, and it took 24 hours for this representative to arrive. 

• The JFO structure did not support execution of the requirements stipulated in the 
Nuclear/ Radiological Incident Annex. Under the July 2007 version of the annex, 
which was the version used during the exercise, DoE is the coordinating agency. 
However, the JFO .structure only includes DoE personnel at ESF-12, which is 
responsible for energy infrastructure ^ As a result, the DoE personnel at the JFO were 


This has since been revised. In ihe September 2007 draft of the NucleHr/Radiologicaf Incident Annex, DHS is the 
coordinating agency for RDD LeiTorisL incidents. 
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not necessarily qualified to provide subject matter expertise regai'ding radiological 
response and protective actions to JFO leadership. ESF-10 (HAZMAT response), for 
which EPA is the coordinating agency, contains more relevant functions but was not 
tasked by JFO leadership to provide subject matter expertise. 

• Prior to the exercise, DoE and EPA exercise planners agreed to incorporate the 
FRMAC within the planning function of a unified command ICS. However, the 
FRMAC is composed of multiple capabilities that align to different ICS components. 
The tactical components of the FRMAC, such as the AMS and the field data 
collection teams, are operational; while the technical, analysis, and advisory 
components ai’e more consistent with planning functions. 

Recommendations: Effective coordination between all levels of government is 
necessary for the federal government to provide timely and adequate support to local 
jurisdictions. Outside of actual disasters, TOPOFF provides the only opportunity to 
establish the entire local, regional, state, tribal, federal, and inteniational command and 
coordination structure in response to a complex event. The full participation of all 
components in Oregon at the incident site and at local, state and federal command 
centers, helped to uncover considerable challenges. 

1 . DHS should convene an interagency working group to address methods for 
improving coordination between federal, state, and local jurisdictions and 
identify concepts and mechanisms to facilitate a “unified management of the 
national response” as called for in the Hurricane Katrina Lessons Learned 
report. 

“ One recommendation from the Hurricane Katrina Lessons Learned 
report that should be further considered is to improve planning and 
coordination at the regional level. 

■ DHS should develop scenario-specific training modules for response 
personnel to improve coordination between federal, state, and local 
jurisdictions. 

■ DHS should continue to sponsor periodic exercises that examine all 
components from the field to the national level to evaluate the 
effectiveness of improvements. 

2. DHS should convene an interagency working group to clarify the relationship 
between ESF-10 and the Nuclear/Radiological Incident Annex in the NRF. 

■ Review the JFO structure and clarify how elements of incident- 
specific annexes should be incorporated. 

■ The September 2007 version of the annex designates DHS as the 
coordinating agency for a terrorist incident throughout response and 
recovery. It also documents some procedures for ESF-10 when the 
annex is activated. Nevertheless, the role of DHS as the coordinating 
agency is still unclear, and the NRF does not address the composition 
of the JFO for scenario-specific incidents when incident annexes are 
activated. 


Section 3: Analysis of Capabilities 55 U.S. Department ot Homeland Security 


For Oti i c i a i Use Only 


For Off i c i a l Us e Onty 

National Exercise Program (NEP) 

After-Actton Report / 

Improvement Plan (AAR/IP) Top Officials 4 (TOPOFF 4) 

■ National -level guidance is needed to address how best to integrate the 
FRMAC into the overall coordination structure during a radiological 
incident. 

3. Future RDD exercises should investigate ongoing changes to the 

Nuclear/Radiological Incident Annex and the transition to environmental 
clean-up and site restoration activities. 

Observation 2.3.5 Area for Improvement: Some agencies had difficulty integrating their 
SOs into the JFO structure. 

Analysis: There were several instances where agencies noted difficulty integrating their 
SOs into the JFO. Examples include the following: 

• The JFO staff was unfamiliar with the role of the Senior Federal Law 
Enforcement Official (SFLEO).^^ 

• The DoE SO in Oregon was asked to support the PFO, which made it difficult for 
the SO to carry out his or her role as part of the JFO coordination group. In 
addition, the JFO and PFO cell were physically separated, further contributing to 
thi.s difficulty.'^* 

Recommendations: Review and clarify the roles and responsibilities of SOs in the 
policies, procedures, and training that support the JFO and PFO cell. The PFO program 
was recently moved to the DHS Office of Operations Coordination, and this office is 
already working to improve the program. The newly revised NRF does contain more 
detailed descriptions of the roles and responsibilities of SOs as part of the Unified 
Coordination Group. 

Observation 2.3.6 Strength: The participation by private sector and CI/KR organizations 
was the largest of any national-level exercise to date.'’*' These organizations participated at 
the national level and in the venues, and helped demonstrate areas where they can most 
effectively contribute to the response. 

Analysis: The exercise demonstrated areas where private sector leaders can add 
significant value to situational awareness and support decision making processes. At the 
national level, this occurred through Office of Infrastructure Protection (OlP)-sponsored 
conference calls and other communication methods. In addition, nine CI/KR sectors 
tested a SIMCELL in the Master Control Cell (MCC) for the first time with industry 
SMEs. By conducting a cross-sector analysis of unfolding events, they recommended 
injects explaining possible business decisions and consequences from government 
decisions. 

In the venues, private sector organizations coordinated with government agencies in a 
variety of ways. In Guam, the private sector was represented in the Territorial EOC and 


This ubservatioii was drawn from FBI input into the after- action process. 

This observation was drawn from DoE input into the after-action process. 

Findings from thi.s section tne drawn in part from the DHS OIP AAR/IP. 
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actively participated in the response. In Arizona, seven of the nineteen sectors identified 
in the NRP co-located in a BOC to assess the disaster’s impact on local industries, assist 
with available resources for incident response and recovery, and pass this information on 
to the state. Officially a private sector entity, the BOC kept a watchful eye on the health 
of Cl and businesses in the aftemiath of the RDD incident. The formal incorporation of 
the private sector into disaster response and recovery operations resulted in regular phone 
and e-mail communication with the Arizona SEOC, and in many ways was a success. For 
example: 

• The BOC responded to numerous RFls from the Arizona SEOC regai'ding private 
sector activities, including the identification of business continuity of operations 
issues, key businesses in the contaminated area, and critical resource capabilities 
within the BOC. 

• The BOC represented industries offered search and rescue, damage assessment, 
and structural decontamination expertise to the Arizona SEOC. 

• The BOC built an inventory of all impacted businesses within the industries 
represented at the BOC. 

Recommendations: Continue to institutionalize and formalize relationships between 
government, private sector, NGOs, and CI/KR organizations. 

Observation 2.3,7 Area for Improvement: Although it was demonstrated that there is 
much the private sector can contribute, the mechanisms for integration into emergency 
response structures are not clear. At the federal, stale, territory, and local levels, there were 
challenges to effective private sector integration. 

Analysis: There are many federal, state, territory, and local agencies with similar and 
overlapping responsibilities for private sector coordination. This complicates private 
sector participation in response and recovery activities. Private sector offices within DHS 
include the DHS Private Sector Office (PSO), OIP Partnership and Outreach Division 
(POD), and the FEMA PSO. The roles and responsibilities of each office are not clear to 
private sector entities, and there is uncertainty on how to best integrate with them during 
emergencies.'*^ 

At the local level, communications and information sharing challenges limited the ability 
of the Arizona BOC to support the response. T4 was the first lime a BOC had been 
established in Arizona, so it lacked formal policies, plans, and systems. In Guam, the 
private sector could have been more effectively integrated into initial discussions and 
decisions about port closure and tourism held at the EOC. Coordination improved later in 
the exercise. 

Recommendations: Clarify private sector partnership models in national policies and 
the national family of plans. The National Infrastructure Protection Plan (NIPP) lays out a 
partnership model. 

1 . DHS should clarify and articulate the purpose, roles, and responsibilities of its 


Findings Irom this section tire drawn in part from the DHS OIP AAR/IP. 
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various PSOs. No DHS office has singular, vested authority and responsibility for 
organizing, leading, planning, programming, or budgeting for private sector 
integration. This issue remains um’esotved in the CI/KR and Private Sector 
Supporting Annexes of the NRF. 

2. State, territory, and local agencies should formalize arrangements with private 
sector partners and develop the policies, plans, and systems necessary to support 
their use in times of emergency. 

3. Articulate and institutionalize a process for private sector and NGO engagement 
in national-level exercises, including authority for planning, programming, and 
budgeting for national and venue working groups. 

Observation 2.3.8 Strength: Disability and special needs play was a major focus area in 
the exercise design. As a result, players gained critical practical experience regarding the 
additional support needed by individuals having special needs. 

Analysis; Accommodations for special needs populations were managed in a variety of 
ways. In Guam, Oregon, and Arizona, press releases were prepared in languages other 
than English. In Guam, for example, press releases were translated into five different 
languages: Chinese, Japanese, Tagalog, Chamorro, and Chuukese. In Arizona, protective 
action guidance was released to the Native American community in the Navaho 
language. 

Victim actors at the Oregon site 
included individuals with hearing, sight, 
mental, and mobility disabilities and 
limited English proficiency. Responders 
had to identify and accommodate these 
victims in the course of the response. In 
another example, the DHS Office for 
Civil Rights and Civil Liberties (CRCL) 
collaborated with the Oregon 
Multnomah County Health Department 
to ensure that consideration was given to 

individuals requiring home healthcare, 
medical care, or supervision when the 
decision was made to shelter-in-place 
over several days, 

Arizona addressed the needs of special populations in the contaminated area through play 
that included individuals with disabilities attending a charity function and the residents of 
an assisted living facility who required evacuation. 

Recommendation: Continue to incorporate special needs play within national-level 
exercises with additional objectives to focus specifically on decisions regarding special 
needs. 



Section 3: Analysis of Capabilities 58 U.S. Department of Homeland Security 


For Offic i a l U se Only 



For Off i c i a l Us e Only 

National Exercise Program (NEP) 

After-Action Report / 

improvement Plan (AAR/IP) Top Officials 4 (TOPOFF 4) 

Observation 2.3.9 Strength: Foreign consular involvement and consular operations were 
successfully exercised. 

Analysis: The addition of foreign consular involvement in T4 added realism to exercise 
play and stressed the capability of domestic responders to handle the international 
dimension of a crisis. Inclusion of consular operations allowed DoS to train federal, state, 
and local authorities on their reporting responsibilities under the Vienna Convention on 
Consular Relations (VCCR). The VCCR obligates competent U.S. authorities, including 
federal, stale, and local government officials, to notify foreign consuls "without delay" of 
the arrest and detention of foreign nationals, deaths of foreign nationals, the appointment 
of guardians for minors or incompetent adults who are foreign nationals, and related 
issues pertaining to the provision of consular services to foreign nationals in the United 
States. 

Consular Response Teams deployed from the three participating countries to Portland. 
DoS also deployed a representative to the JFO in Portland to assist with consular 
activities and to coordinate information sharing. Thus, there was a single source for 
international participants to access and transmit consular information to appropriate, 
national-level stakeholders. 

0bS6rvati0n 2.3.10 Area for Improvement: DoS received a wide range of international 
offers of assistance to the USG during the exercise, but did not accept any because FEMA did 
not activate the IAS. In some cases, accepting these offers may have had diplomatic benefits for 
the USG, but FEMA determined that domestic resources met all incident needs, and no 
international offers were needed, DoS personnel separately considered accepting cash donations, 
which are easy to manage, but the procedures to do so were not clear to FEMA or DoS 
personnel. 

Analysis: DoS received a wide range of international offers of assistance to the USG 
during the exercise that included commodities, personnel, and cash donations. DoS 
forwarded all offers of assistance to FEMA, and FEMA responded with the 
recommendation to urge the donations be made to NGOs. FEMA determined that 
domestic resources met all incident needs and thus, did not activate the IAS. 

The IAS is designed primarily for offers of commodities and services. The IAS CONORS 
outlines the procedures for activation and use of the IAS. Managing the acceptance of 
such offers can be challenging for several reasons: liability or licensing concerns may 
preclude assistance by foreign personnel, and commodities require logistical 
arrangements to be made. Additionally, there may be cases when the USG should accept 
non-cash donations from countries deemed Diplomatically Critical (DC) by a DoS policy 
decision. In this situation, DoS provides FEMA with a list of countries designated as DC, 
and the two coordinate with USAID to identify particular items that can be accepted. 
FEMA makes the final decision on items to be accepted. 

Cash donations, whether from a DC country or not, are easier to manage, and DoS 
considered accepting cash donations during the exercise. The ''^Procedures for Foreign 

This observation was drawn from DoS input into the after-aetion process. 
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Cash Donations Offered in Response to a Disaster Affecting the United State s^\ June 22, 
2007, describes procedures for cash donations. Unlike the IAS activation, the procedure 
for accepting international cash donations requires joint agreement among the secretiuies 
of state and homeland security, together with the assistants to the president for national 
and homeland security. In the absence of this top-level decision being made during the 
exercise, participants came to the conclusion that IAS activation was required to accept 
cash donations. 

On October 18, the fourth day of the exercise, DoS asked FEMA to make a determination 
about accepting cash donations. If FEMA agreed, DoS was prepared to convene a cash 
donations working group to evaluate whether accepting cash donations was advisable on 
a country-by-country basis, as called for in the procedure. FEMA replied that before 
activating foreign cash donations procedures, it would like DoS to verify that it had 
responded to each financial offer with the recommendation that the host government 
transmit the donation via NGOs per the list on FEMA.gov. If a host government insisted 
on making cash donations directly to the USG, FEMA agreed to discuss activating the 
foreign cash donations procedures. DoS had already responded to each offer with this 
recommendation. The exercise ended before DoS received a response from FEMA 
regarding activation of the IAS for cash donations. 

Recommendations: DoS, DHS, and the interagency working group that developed the 
IAS CONOPS should review both the CONOPS and cash donations procedure, and 
clarify these two documents and the procedures for considering and accepting both cash 
donations and donations from DC countries. Merging the documents into a single 
CONOPS for clai'ity may be useful. 

Capability 3: Public Information and Warning 

Capability Summary: This capability includes the development, coordination, and 
dissemination of accurate alerts and emergency information to the media and the public before, 
during, and after an emergency. 

Public information and warning was a critical component of the T4 exercise. JlCs, which 
consisted of federal, state, territory, and local PIOs, were set up in each of the incident locations. 
The JICs in Guam and Arizona were established in pre-existing joint information facilities; the 
Oregon JIC was set up in a hotel. In addition, ESF-15 was activated and functioned as the 
external affairs arm of the Guam and Arizona lOFs and the Oregon JFO. DHS Office of Public 
Affairs (OPA) selected external affair officers based on their background in law enforcement and 
terrorism. A senior FBI public affairs official was selected as the external affairs officer for 
Oregon and an ATF public affairs officer was chosen as the deputy external affairs officer for 
Arizona. At the national level, the National JIC operated at DHS Headquarters in Washington, 
DC. The National JIC included representatives from FEMA, NORTHCOM/DoD, FBI, ARC, 
EPA, DHS CRCL, DHS PSO, CI/KR organizations, and Canada, The communication methods 
employed by public affairs officials included e-mail, press releases, public statements, and 
interview appearances on VNN, 

T4 demonstrated improved coordination among PIOs, which is partly the result of improvements 
implemented after Hunicane Katrina. One key challenge was that officials had difficulty 
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explaining why different protective actions were taken by jurisdictions in different locations. 

Also contributing to this issue was that decision makers and PlOs had difficulty integrating and 
explaining scientific information like plume model results. Similar problems were observed 
during T3. 

The table below provides a summary of all of the observations described under this capability 
along with associated recommendations, where applicable. 


Table 3.7 Summary of Public Information and Warning Observations 


Observation 

Recommendation 

Activity 3.1: Establish JIC/ JIS 

3.1,1 Strength: The National JIC coordinated 
regular teleconferences that facilitated 
information sharing and strategic guidance. 

Continue the use of teleconferences to share 
information and consider further methods to 
share information and coordinate messaging. 

3.1.2 Area for Improvement: Information 
overload was a problem among public affairs 
officials. 

Continue to develop and streamline 
infonnation sharing tools, processes and 
procedures. 

Activity 3.2: Disseminate/ Issue Emergency Public Information and Alerts/ Warnings 

3.2.1 Strength: Statements from federal and relief agencies were consistent in their 
messaging for local populations to look to their local-level governments for protective action 
guidance. 

3.2.2 Strength: Statements from federal, territory, state, and local governments, as well as 
relief agencies, were consistent in their recommendations of how to seek protection from 
radioactive contamination while sheltering-in-place. 

3.2.3 Area for Improvement: Public 

officials had difficulty explaining the reasoning 
behind the protective action guidelines to 
evacuate and shelter-in-place. 

Consider the role of the federal government 
in coordinating the explanation of different 
actions by local jurisdictions. Review and 
update related policies and procedures for 
strategic communications. Investigate ways 
to facilitate the integration of scientific 
information into public messaging and 
decision making. 


Activity 3.1 ; Establish a JIC/ JI5 

Observation 3.1.1 Strength: The National JIC coordinated several regular 
teleconferences that facilitated the exchange of information and strategic guidance. 

Analysis: Public information coordination mechanisms have matured both through use 
in previous exercises and actual incidents. The following calls were well-attended and 
deemed valuable by participants: 

• National Incident Communications Conference Line (NICCL) Calls 

• White House Communications Calls 

• Special Media Line Calls 
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These calls are examples of strategic and operational-level calls that contribute to the 
federal interagency operational cycle discussed in observation 2.3.1. The focus of these 
calls was public messaging and the primary participants were public affairs personnel. 

NICCL Calls; According to the July 2006 ESF-15 SOPs, the NICCL is “used for 
ti’ansmission and exchange of critical and timely incident information among federal and 
affected state, local, and tribal authorities.” Two calls were held each day with federal 
agency PIOs and the affected venues (ESF-15 leads and state PIOs). The ESF-15 and 
federal and state JIC directors reported that the calls were valuable because they were 
well organized, provided an overview of federal agency activities, and provided an 
opportunity to communicate issues. A few shortcomings were identified, including that 
the calls were lengthy, there were a large number and variety of attendees (making some 
participants uneasy about information they should share), and there was .some 
misunderstanding about which agencies should participate in the call. 

White House Communications Calls: Each morning, leadership from the White House, 
the National JIC, and ESF-15 conducted a conference call to discuss sti’ategic messaging 
guidance from the White House and to provide venue updates. ESF-15 leads felt that it 
was very valuable to have this line of communication directly with the White House. 
(Note that due to time differences, the Guam venue was not able to participate in all 
calls.) -yf 

Special Media Line Calls: First used during the response to Hurricane Katrina, these 
calls were coordinated by the DHS press secretary to provide information to the media 
and answer questions. PIOs from DHS and other federal agencies participated in the 
calls. Participants felt that these calls helped reduce the call volume from the media and 
increased the situational awareness of activities in other agencies. 

Recommendations: Continue the use of teleconferences to share information with the 
media and among PIOs. 

1 . To reduce the length of NICCL calls, consider virtual tools (such as chat rooms or 
web conferencing) where participants can post briefing points. 

2. For multi-venue incidents, consider adding ad-hoc small group calls for ESF-15 
leads to coordinate messaging. 

Observation 3.1 .2 Area for Improvement: PIOs reported that information overload 
was a problem. Managing the large volume of e-mail communications drew the attention 
of PIOs away from other duties and hindered information sharing and situational 
awareness. 

Analysis: The National JIC employed several mechanisms to support ESF-15 and PIO 
coordination through written means, including: 

• National JIC e-mails. 


Though strategic communications was addressed, many strategic activities, such as presidential statements, were 
notional. 
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• Posting materials on H SIN. 

These coordination mechanisms have also matured through use in previous exercises and 
actual incidents. However, PIOs still could not effectively manage the volume of 
information being pushed to them through e-mails and often did not use mechanisms that 
required information to be pulled, like HSIN. 

Summaries of the NICCL calls, ESF-15 daily communications summaries, press releases 
generated by the National JIC, and venue press releases sent to the National JIC were 
distributed to a large e-mail distribution list, which consisted of ESF-15 national 
leadership. National JIC contacts, and venue contacts (ESF-IS leadership and staff, JFO 
leadership, JIC leadership and staff, state PIOs, and several other related PIOs). Figure 
3.8 shows the large number of e-mails sent by the National JIC to this distribution list. 
The total e-mails by day are broken down by their primary content. 

Figure 3.8: Number of E-mails Sent by tbe National JIC to the Distribution List 
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Participants reported that e-mail was useful to see what is.sues other venues were 
addressing. However, the biggest drawback to the National JIC e-mails was infoimation 
overload. T4 PIOs received hundreds of e-mail messages and some did not have time to 
read the releases. Many times the messages went unread or were simply deleted. 


A considerable amount of the information was duplicative. For example, venues often 
received their own press releases from the National JIC. The same information also 
appeared in a variety of press releases. It is important to note that although the 
duplication increased the volume of information, some found it useful because they felt 
that repeated information provided an indiaatichi ‘of ythat was important and also served 
as a confirmation that the National JIC received what .they had sent. 

Smart practices evolved to manage the volume bf iliformation: 

'>■ I ii'M . 

• The Arizona JIC created an update release that was distributed every two hours. 
Information was organized by topic (e.g., health, law enforcement, etc.) and new 
information appeared in bold text. The format enabled readers to easily identify the 
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new information, while still providing comprehensive information to those who did 
not read the previous release. This process was repeated each day of the exercise. As 
a result, the number of press releases issued was significantly reduced from 
approximately 50 on the first day of the exercise to six on the following day. Because 
of its success, the practice was adopted by the other two T4 venues and the National 
JIC. Two key elements were necessary: 

■ The JIC needs to be up and running. Before this coordination mechanism is in 
place, independent press releases would still be needed to fill the infoianation 
void. As the incident transitions to greater management, consolidated 
messaging becomes possible, 

■ Update releases requires buy-in of JIC participants. Some participants were 
initially reluctant because they wanted to disseminate their own information. 
However, they agreed to the process when they understood that a consolidated 
release would ensure that their information did not get lost in a larger number 
of releases, it would decrease their workload, and that statements could still be 
sent out separately when needed (emphasizing their importance). 

• Arizona developed a media monitoring report that also covered the Guam venue. This 
reduced the workload required in Guam. 

• Some public affairs officials assigned staff to read e-mails and notify ESF-15 and JIC 
leads of important information. If staff is available to do this, it frees directors to 
spend time with operations and other coordinating officers. 

• Oregon sent the e-mails to a common mailbox and sorted them into different folders 
for action. 

T4 PIOs also made suggestions based on their experience: 

• Establish definitions for routine, priority, and immediate messages and label tliem. 
People receiving the messages would then have an indication of the importance of the 
messages and could handle them accordingly. 

• Post press releases on a website for review and retrieval. A media monitor could 
watch for information and organize it in a logical manner. 

• Conduct small group discussions (conference calls) among ESF-15 leads to 
coordinate messaging across locations (also a recommendation under observation 
3.1.1). 

• The National JIC could play a greater role in consolidating the messages. 

Information from each venue was posted on HSIN, however, ESF-15 leads and PIOs 
reported that they did not use this re.source. There were several reasons for this: some 
exercise participants did not have accounts on HSIN, organizations used different 
software (e.g., WebEOC), or they did not have time or resources to pull the information. 
This was an issue in general for the entire response community as described in 
observation 2, 1 ,2, 

Recommendations: Continue to develop and streamline information sharing tools 
with supporting processes and procedures. 
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1 . Evaluate smart practices and suggestions on infomiation management that 
emerged during T4 to reduce the information overload problem. Update relevant 
ESF- 1 5 SOPs and training. 

2. Develop information technology solutions that support e-mail distribution lists so 
that recipients can be easily added or removed. Consider developing alternate lists 
for high and low volumes to accommodate different stakeholders. 

These improvements might also help address similar issues experienced by other 
response personnel. 

Activity 3.2; Disseminate/ Issue Emergency Public Information and Alerts/ 
Warnings 

Observation 3.2.1 Strength: Statements from federal and relief agencies were consistent 
in their messaging for local populations to look to their local governments for protective 
action guidance. 

Analysis: Throughout the exercise, and noticeably in the early phases of the response, 
officials from public and private agencies consistently communicated that state and local 
authorities were the decision makers. On occasions, when asked to comment about the 
response in different localities, officials repeated the fact that local officials were in 
charge and residents should look to them for specific protective action guidance. This 
consistency was reflected in press releases from government and relief agencies, 
communications from the National JIC, and in VNN interviews featuring senior-level 
federal and state officials as well as technical SMEs. 


Observation 3.2.2 Strength: Statements from federal, territory, state, and local 
governments, as well as relief agencies, were consistent in their guidance about how to seek 
protection from radioactive contamination while sheltering-in- place. 

Analysis: Authorities in the different incident locations issued shelter-in-place 
instructions, in the immediate aftermath of the RDD explosions. Without exception, all 
authorities offered the same protective action guidelines to minimize contamination while 
sheltering-in-place. These guidelines included finding shelter inside a building, closing 
the windows, turning off any heating or ventilation system, removing clothing and 
placing it in an isolated plastic bag, and taking a shower. 

Obsarvation 3.2.3 Area for Improvenrient: Public officials had difficulty explaining the 
reasoning behind the protective action guidelines to evacuate and shelter-in-place. Faced with 
similar information and scenarios, different decisions about protective actions (evacuation 
versus shelter-in-place) were made in each of the venues. These were difficult choices that 
required decision makers to act quickly while assessing scientific model results and 
conditions specific to their locality. The mock media repeatedly questioned federal, state, 
teiTitory, and local officials about this disparity. 

Analysis: At all three incident sites, territory, state, and local authorities issued 

Section 3: Analysis of Capabilities 65 U.S. Department ot Homeland Security 


For Oti i c iai Use Only 


For Oftfc i a l Us e Only 

National Exercise Program (NEP) 

After-Action Report / 

improvement Plan (AAR/IP) Top Officials 4 (TOPOFF 4) 

protective action guidelines in response to the explosions and radiation detection. As the 
response to the incidents progressed, authorities in each location adjusted their 
recommendations accordingly: 

• In Guam, after several hours of sheltering-in-place, officials ordered and executed 
(notionally) the evacuation of the 300 personnel at the incident site (Cabras power 
plant) and surrounding area. 

• In Arizona, residents were initially advised to shelter-in-place. Within two hours, 
state officials advised residents to shelter-in-place and said that state personnel 
were assisting with evacuations from the immediate area of the incident. Over the 
next few hours, conflicting messages about evacuation and sheltering-in-place 
appeared in press releases, Arizona's informational website {AZ2H.org), and in 
reports on VNN.com. However, within seven hours of the incident, specified 
regions of Tempe and Mesa were being evacuated. Residents outside the 
immediate area were advised to stay indoors. By the evening of October 17, 
residents were instructed that no further evacuation.s would be called and that they 
should remain in their homes. 

• In Oregon, local officials 
immediately recommended that all 
residents in the city (including 
businesses) shelter-in-place. While 
public officials stated during VNN 
interviews that evacuation plans 
would be ready by late in the 
afternoon on October 16, no 
evacuation plans were released; 
instead, a new shelter-in-place zone 
was delineated that more specifically 
defined the plume area. Early on the 
morning of October 17, a refined 
shelter-in-place boundary was 
released and residents outside the 
emergency zone were notified that 
tliey need not take any specific 
protective actions; residents inside 
the emergency zone were instructed to continue to shelter-in-place. By the 
morning of October 18, residents in the emergency zone were allowed to 
voluntarily evacuate to decontamination centers but were still encouraged to 
shelter-in-place. 

The most notable difference in protective actions was an early decision to evacuate in 
Arizona while Oregon issued a shelter-in-place order for the entire city. Public officials 
were pressured by VNN and other simulated media to explain why recommendations to 
evacuate or shelter-in-place were not consistent across the incident locations. No press 
releases from any of the locations provided a direct explanation for these differences even 
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when VNN coverage aggressively pursued this issue. Public officials at all levels of 

government were called upon to explain the different responses. 

There were several challenges to effective public messaging in this scenario: 

• Federal officials were repeatedly asked to comment on and explain local 
protective action decisions, which is the responsibility of local officials, 

• The reluctance of some officials to provide and explain technical products like 
plume model results was interpreted as “withholding information”, especially 
after officials in other locations had chosen to release them. 

• Protective action decisions were based on scientific concepts that are difficult to 
explain. 

Specific examples of these challenges follow; 

• During an interview with VNN on October 17, a DHS senior official stated that it 
was up to the local government officials to work with the best scientific 
information to make decisions about their localities. He was pressed to explain 
why the different cities and states adopted different guidelines, and while he 
repeatedly stated the decisions were up to local officials at each location, he 
mentioned that the decision makers would take into a “host of factors”, 
specifically citing weather and geography. VNN focused on the weather-related 
aspect, later commenting that the different reactions “must suggest that the 
weather is on two different planets.” 

• In a VNN interview on the evening of October 16, a local official from Portland 
indicated that plume model results would be forthcoming and shaied with the 
media that the city was considering an evacuation. In an interview early in the 
next day’s VNN broadcast, the official explained that the models were not 
released as promised because they kept changing throughout the afternoon. The 
VNN anchor challenged the local officials’ decision to continue to shelter-in- 
place, positing that evacuation would have made common sense. The official 
defended his position by saying he did not want residents outside “walking in the 
plume.” 

• Federal officials were consistent with officials in Oregon in reasoning that plume 
model results should not be released. On October 17, Secretary Chertoff stated, 
“We do not generally release the plume model, “He explained that because of the 
technical expertise required to interpret them, there is a risk that residents could 
misread the plume model results and put themselves in jeopardy. Officials in 
Guam and Arizona, however, did release plume model results. During the first 
joint press conference with the Arizona state officials at 4:55 p.m. EDT on 
October 16, they displayed a map of the plume, stating that the yellow area 
contained the radiation. Guam officials also released plume model results to their 
residents. This fact was not lost on the VNN news anchors, who asked: If the 
plume model was released in Guam, why was it not released in Oregon? In 
concluding the discussion about the unreleased plume model results, one anchor 
remarked that, “I’m pretty sure I could look at a plume and not go crazy.” 
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• Officials from IMAAC and National Oceanic and Atmospheric Administration 
(NOAA) were also pressed for information on plume model results during a VNN 
interview at 12:50 p.m. EDT on October 17. To the consternation of the VNN 
anchor, the officials expressed their concern about releasing the plume model 
results to the public because of their technical nature and then deferred many 
questions to the local incident commanders. 

• A local public official refused to discuss technically-focused information without 
the assistance of an SME, even though he held the printed information in his 
hands during the interview on VNN, 

Contributing factors common to all of the above examples are the scientific terms and 
definitions (e.g., reins, isotopes, gamma rays. Roentgens) necessary to explain radiation 
exposure, and the need for SMEs to explain the findings. A particular difficulty in 
communicating radiation warnings through public information channels is the automatic 
association of the word “radiation” with “nuclear.” Factors such as time of exposure, 
distance to the radiation source, and strength of the radiation source all affect the health 
consequences of radiation exposure. One approach to discussing radiation that was 
adopted by the various public officials was to discuss the exposure in familial' terms such 
as chest x-rays and CAT scans. However, reporters then questioned why minor 
contamination levels triggered the evacuation of thousands of people. It was only when a 
FRMAC official appeared on VNN at 3:36 p.m. on October 17 that the differences 
between short- and long-term exposure to low levels of radiation were explained. 

The reluctance to release technical information could be explained by the inherent trade- 
offs between releasing information as quickly as possible (i.e., the motive of the public 
affairs community) and releasing the most accurate information possible (i.e., the motive 
of the scientific community). Plume model results are particularly susceptible to this 
problem; initial maps are only predictions and become more accurate over time as 
additional data are collected. 

The challenges faced by public affairs officials could have been at least partially 
alleviated with some coordination in messaging among the incident locations. While the 
ESF-15 directors in each location had discussions in morning briefings with the White 
House and during NICCL calls, the state and local officials in different venues did not 
have much opportunity to talk with one another. While local officials were aware that the 
other locations adopted different guidelines, there is no evidence that they made an effort 
to deconflict their messaging. On occasions when officials defended their respective 
decisions, they stated confidently that they had made the right decision for their residents. 
The media questioned how Oregon and Arizona could both be conect in offering 
differing guidelines. The National JIC addressed this issue on one occasion: on the 
evening of October 17, it distributed the ESF-15 Daily Communications Strategy for 
October 1 8 via e-mail that included some general guidance on how to message the 
disparate protective action guidelines. 

Recommendations: Tlie effective incorporation of scientific information into public 
messaging is vital to mitigate the issues discussed above. In addition, officials should 
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work to improve the transpai'ency of their operations before the media becomes openly 
skeptical of their actions. 

1 . Clarify the role of the federal goveniment in coordinating the explanation of 
different actions by local jurisdictions and review and update related policies 
and procedures for strategic communications. According to the NRF: “the 
Federal team must operate and speak with a unified voice and consistent 
message that is coordinated not only with the different Federal authorities 
involved in an incident, but also with affected State, tribal, and local 
authorities.” 

2. The federal government should investigate ways to facilitate the integration of 
scientific information into public messaging. This integration requires the 
support of SMEs. Potential actions include the following: 

■ Conference calls could be a forum for experts to explain technical 
products to PlOs and work with them to develop an appropriate message 
for the public. 

■ Public affairs agencies could identify SMEs to provide support to JICs. 

The National JIC made use of one such SME. States may be able to 
identify and provide their own SMEs. 

The DHS-led IMAAC Working Group and the FRMAC are currently developing 
recommendations for hazard area graphics (maps ajid summary language) for RDDs that 
can be more easily understood by local, state, and federal officials. 

Capability 4; Economic and Community Recovery 

Capability Summary: Economic and Community Recovery is the capability to implement 
short- and long-term recovery and mitigation processes after an incident. This includes 
identifying the extent of damage caused by an incident, conducting thorough post-event 
assessments, and determining and providing the support needed for recovery and restoration 
activities to minimize future loss from a similar event. 

Recovei 7 activities began during the FSE as recovery planning cells were established in the 
venues and at the FEMA NRCC. Discussion about recovery issues continued through short-term 
recovery (STR) TTXs and workshops conducted after the FSE concluded. On December 4-5, 
2007, DHS held an LTR TTX to discuss key technical, operational, and policy challenges 
surrounding recovery from an RDD incident 50 days after the detonation. 

The presence of radiation affects all aspects of recovery. It would complicate debris removal, 
storage, transportation, and disposal; cause populations to be displaced to other locations; create 
a complex environmental clean-up situation; lead to the long-term monitoring of workers and 
affected populations; and raise insurance and liability issues. One key gap noted across all 
exercise events was the lack of comprehensive planning for recovery. The table below provides a 
summary of the observations described under this capability along with associated 
recommendations, where applicable. 
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Table 3.S Summary Economic and Community Recovery Observations 


Observation 

Recommendation 

Activity 4.1: Direct Economic and Community Recovery Operations 

4,1.1 Strength: Recovery planning cells were established early in all of the venues and at the 
federal level. 

4. 1 .2 Area for Improvement: Current 
written plans lack a comprehensive approach to 
recovery operations. 

Incoiporate recovery into national family of 
plans and regional planning efforts. 

4. L3 Area for Improvement: Participants 
were unfamiliar with the Protective Action 
Gitides for Radiological Dispersal Device 
(RDD) and Improvised Nuclear Device (IND) 
Incidents and the site optimization process for 
setting clean-up standards. 

Provide detailed guidance for implementing 
the site optimization process. 

4. 1 .4 Area for Improvement: There is 
limited laboratory capacity for clinical, 
environmental, and food sample analysis in the 
event of an RDD incident. 

Develop plans that include strategies for 
maximizing existing and expanding clinical, 
environmental, and food laboratory capacity. 


Activity 4.1 : Direct Economic and Community Recovery Operations 

Observation 4.1,1: Strength: During the FSE, recovery planning cells were established in 
all of the venues and at the federal level. 

Analysis: At the conclusion of the FSE, STR and LTR issues were discussed and 
preliminary draft plans were being de veloped in all of the venues. For example, the 
FEMA NRCC established a recovery planning cell that included expertise across all 
ESFs. In Oregon, the governor established a recovery planning cell on the day of the 
explosion, and subsequently established a recovery cabinet to focus on the transition from 
STR to LTR. In Guam, preliminary plans were developed to ensure delivery of goods and 
services, and disaster assistance specialists were part of the first cadre of personnel that 
arrived in venue. In Arizona, a plan for establishing a state-wide recovery task force was 
discussed. 

Observation 4.1.2 Area for Improvement: Many participants across federal, state, 
territorial, and local D/As cited the lack of comprehensive recovery planning. 

Analysis: Participants in the STR and LTR TTXs raised concerns about the lack of a 
comprehensive, unified strategy and plan for both STR and LTR. The general conclusion 
of these discussions was that the NRP did not adequately address the recovery phase. 
Although DHS organizes preparedness and emergency response in terms of four missions 
(i.e., “prevent, protect, respond, recover”) the emphasis of the NRP is evident in its title. 
The NRP/NRF does assign the recovery mission to ESF-14, the Emergency Support 
Function for Long-Term Community Recovery and Mitigation. But the mission of ESF-14 
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is to provide: 1 ) funding resource identification and coordination, 2) technical assistance 
in the form of impact analyses, and 3) planning support to the state recovery authorities. 
Given the complexity of recovery operations at all levels of government and in 
coordination with the private sector and with NGOs and voluntary organizations, the 
NRP falls short. Similarly, the NPSs in the DHS Capabilities-Based Planning construct 
fail to adequately address LTR.^^ 

Other related issues concern the role of the federal government in LTR as well as the 
capabilities and resources it can bring to bear. During an incident response, ESF-14 
functions most prominently within the operations section of the JFO. Many participants 
said that they were not effectively integrated into this JFO function during past responses. 
Once the response is over, the JFO stands down, and ESF-14 is deactivated, there are no 
comparable organizations or entities to take over their roles during the recovery phase. In 
the past, entities such as the President’s Gulf Coast Recovery and Rebuilding Council 
have been created, but only on an ad-hoc basis. The absence of response-like recovery 
entities led some LTR TTX participants to ask, “Who’s in charge?”^^ Others noted the 
difficulty of navigating the myriad of individual assistance programs provided by federal 
D/As, determining what programs are available, and how they can be accessed. 

The LTR TTX also highlighted additional challenges during the recovery phase. These 
included: 

• Tliere is limited availability and capacity for disposal of radioactively- 
contaminated waste, including debris. Participants identified the need to identify 
available disposal capacity and potential gaps for radiological waste.^^ All agreed 
that coordination between the federal agencies that regulate radioactive waste 
disposal and the states that allow temporary storage and long-term disposal will 
be important. 

• There is an increased demand on the infrastmcture/services outside of the 
incident site due to evacuated and displaced populations. Because of mass 
evacuations, jurisdictions away neai" the incident site would likely experience 
high demands on infrastructure and services for an extended period of time. 
Because of restrictions to areas that experience damage, the Stafford Act may not 
cover locations that receive evacuees. 

• Reliance on single sources of Cl results in unnecessai'y vulnerability. Although 
the RDDs did not contaminate the water supplies in the affected states, it would 
have been useful to consider the potential challenges that local, state, territoiy, 
and federal governments would have faced if any of the water plants were in the 
contaminated ai'ea. States and responsible agencies addressed the various risks of 
only having a single source of water, and the need to develop alternative plans 


Some additional inttmuaLioii regarding recovery planning and coordination at the federal, .state, and local levels 
has been added to the NRF. However, the NRF .still maintains that LTR is outside the scope of the document. 

The NRF describes some examples of federal, state, and local coordination, but maintain.s that re.sponsibilities 
shift to individual agencies with primary recovery responsibilities after the JFO do.ses. 

One lesson learned from the Goiana (Brazil) Cs-I.^7 clean-up is that early identification of disposal paths for 
clean-up waste is necessary to prevent delay of clean-up. 
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for drinking water. Participants agreed that all water systems needed to establish 
contingency plans for how to respond if the primary water source became 
contaminated. 

• There is a need to coordinate access control within contaminated areas. 
Participants expressed concern about past difficulties that truckers would 
experience in gaining credentials and pennission to access affected ai'eas. The 
resulting delays would adversely affect the delivery of needed supplies and 
materials, and would ultimately increase LTR costs. The group debated whether 
this would remain a problem at D+50 and whether this was properly the role of 
the federal government, since local law enforcement agencies are generally 
responsible for area control . 

• There is a requirement to conduct long-term monitoring of workers and the 
exposed population. Plans and procedures should be developed to rapidly 
mobilize monitoring equipment and collect samples. 

• Many participants were unfamiliar with the Environment, Food, and Health 
Advisory Team’s (A-Team) function because it is not well-defined. The A-Team 
is an interagency group, but it lacks a single point of leadership. The initial 
purpose of the A-Team was to advise decision makers on questions regarding 
food and health. However, this resource was not used effectively during the FSE 
because states and agencies were unaware of the group. 

• State and local governments are unfamiliar with federal disaster mental health 
operations and disaster surge capability. Participants unanimously agreed that an 
RDD attack would require different approaches than responses to any other types 
of disaster. Although there are many disaster mental health programs in place, 
often they are underutilized because agencies and governments are unaware of 
their existence. Representatives of states and agencies also saw public messaging 
as key to addressing disaster mental health issues. Conveying guidance and 
information to the public and explaining the government’s response to the attack 
should reassure citizens that authorities are in control of the situation, reducing 
the psychological impact. This need for consistent public messaging also raises 
the issue of how long a JIC would continue to function after an incident. 

• Private sector recovery challenges to an RDD attack include concern about the 
liability risk for remediation contractors and reluctance of businesses to return to 
a contaminated area. There was uncertainty regarding the process for property 
condemnation, reimbursement, and subsequent reoccupation of condemned and 
contaminated structures after receiving certification for reoccupation. Participants 
identified the need to clarify the roles and responsibilities of federal, state, 
territory, and local jurisdictions, as well as the role of the private sector. In 
addition, participants noted that decision makers should manage public 
expectations through pre-incident education and strategic public messaging. 

The delegation from Guam repeatedly emphasized the need to address the unique 
challenges faced by their island community and by other tenatories, islands, and tribal 
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areas as well. Although Guam was spared island-wide contamination because of the 
western location of the simulated RDD attack and the prevailing westerly winds, the 
effects of the attack were nevertheless particularly severe for the territory. Guam relies on 
imports via ocean transportation for most of the goods and materials it needs. The closure 
of the commercial port, even with the stopgap opening of the pier facilities of the U.S. 
naval base for commercial activity, would have had a drastic effect on the economy. 
Furthermore, a large component of the economy in Guam is dependent upon the tourism 
industry. The stigma of radioactive contamination poses a real threat to that industry. In 
addition, the Cabras port complex is the primary transshipment hub for Micronesia and 
the larger Western Pacific island region. While the port of the Commonwealth of the 
Northern Mariana in Saipan could have absorbed some of this function after the attack, 
its cargo handling capacity does not match Guam’s. 

Recommendations: Decision makers should consider implementing the following; 

1 . Expand the NRF to include recovery operations, which should address; 

■ The organizational structure for LTR. 

■ The role of government, NGOs, and private sector organizations. 

■ Strategic communications and continued activation of the JIC. 

■ The needs of unique entities (e.g., territories, islands, and tribal lands). 

2. Develop supporting policies and procedures for implementing recovery activities 
following an event and incorporate recovery into scenario-based plans like the 
RDD Strategic Plan. These should include policies and procedures to address 
disposal of contaminated waste, the impact of displaced populations on 
surrounding communities, reliance on single sources of Cl, coordination of access 
control within contaminated areas, long-term monitoring of workers and the 
exposed population, mental health operations, and private sector concerns. 

3. Develop appropriate training programs for private and public sector entities to 
support policies and procedures for implementing recovery operations. 

4. Develop guidance documents - in particular for individual assistance programs - 
to help state and local organizations navigate and access the variety of programs 
available through FEMA and other agencies. 

5. Expand the scope of the interagency NPSs to include LTR needs, with particulai’ 
attention to the unique needs of non-contiguous geographic states/territories. 

Observation 4.1.3 Area for Improvement: Participants were unfamiliar with the 
January 2006 DHS Preparedness Directorate’s; Protective Action Guides for Radiological 
Dispersal Device (RDD) and Improvised Nuclear Device (IND) Incidents regarding the site 
optimization process for setting and implementing clean-up standards following an RDD 
incident. This document has undergone a public comment period and will be finalized soon. 

Analysis: During the LTR TTX, participants voiced concern regarding DHS guidance 
for responding to, and recovering from, an RDD event. Some participants felt that the 
guidelines should more clearly define a predetermined range of clean-up standards. 
However, one of the purposes of the 2006 guidance is to describe federal interactions 
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with state and local governments, and to establish the principle of site-specific 
optimization. Site-specific optimization allows for state and local governments to 
determine acceptable risk for their community/jiirisdiction and account for factors such as 
land use and background levels of radiation. The guidance also urges state and local 
decision makers to consider the societal, economic, medical, and environmental impacts 
of a range of site clean-up levels. For example, an acceptable level of risk for a rural area 
will most likely be different than an acceptable level of risk for a densely populated 
(urban) environment. 

Once the site-specific clean-up level is established, decision makers should develop a 
strategic plan to ensure consistency of public messaging, and to manage public 
expectations. The federal government needs to be prepared to explain and support 
different clean-up choices. Similar circumstances were observed during the FSE when 
jurisdictions took different protective actions immediately following the explosions, and 
caused significant public messaging problems. 

Recommendation; Develop detailed interagency guidance for implementing the 
optimization process. 

Observation 4,1 .4 Area for Improvement: There is limited national laboratory capacity 
for clinical, environmental, and food sample analysis in the event of an RDD incident. 

Analysis; During the FSE, the venues had limited laboratory capacity to assess 
radionuclides in clinical, environmental, and food samples. This issue was discussed 
further during the STR and LTR TTXs, where participants identified this as a federal 
responsibility. 

Clinical: Currently, the Centers for Disease Control and Prevention (CDC) has no valid 
method to test clinical specimens in a radiological emergency for seven of the thirteen 
highest priority radioisotopes most likely to be used in a terrorist scenario. For those 
isotopes with existing validated methods, screening 100,000 clinical specimens in the 

"IQ 

wake of a radiological attack could take more than four years to complete." The existing 
Laboratory Response Network (LRN) supports chemical and biological testing, but has 
limited capacity for radionuclide analysis in clinical and non-clinical specimens. Only the 
CDC and the National Institutes of Health (NIH) labs within HHS can perform this 
analysis. As such, a need to develop a pre-screening process to determine the segment of 
the population that would require further radionuclide analysis was identified. This 
prescreening process would decrease the number of samples sent to laboratories, and 
allow Jurisdictions to obtain the necessary lab results to rapidly distribute medication to 
those individuals that were exposed. 

The CDC dispatched an aircraft to fly 100 samples from Oregon to NIH to test NIH’s 
laboratory capacity. Although NIH was able to provide initial results to the state in 36 
hours, it became evident that 100 samples was a stress on NIH’s capacity. NIH estimated 
that it would be able to completely process and assess approximately 65 - 100 samples a 


U.S. Representative Brad Miller. Radiological Response: Assessing Environmental and Clinical Laboratory: U.S 
House of Representatives Commiiiee on Science and Technology. October 25, 2007. 
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day. HHS does not have sufficient capacity to detemnine the level of exposure for a large 
population. 

The Arizona Department of Health Services (ADHS) also requested CDC laboratory 
assistance for radiological testing since it did not have this capability. This created 
additional sti’ain on CDC and NIH resources and caused a backlog of samples for testing 
that remained at D+50. Without the necessary laboratory assessments, the states were 
unable to provide an accurate estimate of the number of individuals who might require 
Prussian Blue following these events. This led to the venues to request excess doses of 
Prussian Blue and push requests for federal financing of the unused doses. 

Environmental: The EPA predicts that it could take as long as two years to analyze the 
350,000 samples necessary to conduct a thorough environmental analysis, given the 
nation’s current radiochemistry laboratory infrastructure.^” Limited availability and 
access to qualified laboratory technicians to perform the necessary analyses create a 
significant shortfall in laboratory capacity. Environmental sampling requires specific 
expertise, qualification, and equipment, depending on the type of sampling to be 
performed. During an RDD event, it is imperative that state D/As are aware of which 
laboratories are available for the needed environmental assessments. 

In addition, LTR TTX participants discussed the importance of developing clear 
objectives for sampling and then developing a sampling plan that achieves those 
objectives efficiently. Such planning can help minimize the number of samples requiring 
analysis. 

Food; Laboratory capacity for testing radionuclides in foods is also limited. At D+50, the 
FDA was still assessing the first set of samples it had received. At present, there are only 
three labs in the nation equipped to conduct food testing following an RDD event. 

Recommendations: Develop plans to maximize existing clinical, food, and 
environmental laboratory capacity. 

1. Define and communicate current clinical and food laboratory capacity (EPA has 
defined and communicated environmental laboratory capacity). 

2. Investigate the use of the Integrated Consortium Laboratory Network (ICLN) as a 
formal coordinating entity during times of emergency. 

3. Develop a CONOPS plan that includes strategies for maximizing existing clinical, 
environmental, and food laboratory capacity as well as expanding existing 
laboratory networks for clinical, environmental, and food samples. 

Capability 5: Intelligence/ Information Sharing and Dissemination 

CBp^bility SumiTiary: Intelligence/Information Sharing and Dissemination is the multi- 
jurisdiclional, multidisciplinary exchange and dissemination of information and intelligence 
among the international, federal, state, local, and tribal layers of government, the private sector, 
and citizens. The goal of sharing and dissemination is to facilitate the distribution of relevant. 


U.S. Representative Brad Miller Radiological Response: Asvsessmg Environmental and Clinical Laboratory. U.S 
House of Representatives Comiiiiuee on Science and Technology. October 25, 2007. 
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actionable, timely, and preferably declassified or unclassified information and/or intelligence that 
is updated frequently to the consumers who need it. Related to this capability are information 
gathering activities, such as the collection, consolidation, and retention of raw data and 
information from both human sources and open sources. When analytical products are 
disseminated, they are the result of synthesis of data and information for the purpose of creating 
timely and actionable intelligence with an emphasis on the larger public safety and homeland 
security threat picture. The information provided in this section is summarized from a classified 
annex to this report 

Activity 5.1 Conduct Vertical/ Horizontal Flow of Information 

Observation 5.1.2 Area for Improvement: The Common Intelligence Picture/COP 
varied considerably at the different venues. 

Analysis: The intelligence picture varied. Further analysis will be conducted on data 
collected via the ODNI Evaluator Team and Intelhgence Control Cell. 

Recommendations: See classified annex. 

Observation 5.1.3 Strength: T4 provided a valuable format to examine horizontal and 
vertical flow of intelligence. 

Analysis: The T4 exercise scenario provided the Intelligence Community (1C) an 
opportunity to share and disseminate intelligence and information among law 
enforcement, intelligence, emergency management, and other D/As at the local, 
teiritorial, state, federal, and international levels. 

Observation 5.1 .4 Area for Improvement: Intelligence dissemination shortfalls 
occurred at all levels. 

Analysis: Participants failed to receive several key intelligence reports due to 
classification/tearline and/or information sharing system technology issues. Further 
analysis will be conducted on data collected via the ODNI Evaluator Team and 
Intelligence Control Cell. 

Recommendations: See classified annex. 

Observation 5.1.5 Area for Improvement: Multiple RFI processes and procedures 
created an inefficient and ineffective system. 

Analysis: Multiple RFI processes and procedures created confusion among participants, 
and resulted in incomplete or slow RFI responses. Further analysis will be conducted on 
data collected via the ODNI Evaluator Team and Intelligence Control Cell. 

Recommsndations: See classified annex. 
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Section 4: Conclusion 

More than one hundred organizations were involved in planning T4, including DHS and other 
federal agencies; state, territory, and local agencies from the states of Arizona and Oregon and 
the U,S. Territory of Guam; private sector entities and NGOs; and three international partners: 
Canada, the United Kingdom, and Australia. The T4 FSE used an RDD scenario to test the full 
range of federal, state, territorial, and local capabilities. This scenai'io included coordinated 
attacks in Guam, Oregon, and Arizona. 

A major goal of T4 was to test existing plans, policies, and procedures to identify planning and 
resource gaps, and ultimately to implement corrective actions to improve the state of the nation’s 
WMD preparedness. Nearly every capability in the DHS TCL was exercised. This AAR focused 
on national policy and planning issues related to five of those capabilities: On-Site Incident 
Management, Emergency Operations Center Management, Emergency Public Information and 
Warning, Economic and Community Recovery, and Intelligence/Information Sharing and 
Dissemination. The overall exercise was successful in highlighting improvements since previous 
exercises and Hurricane Katrina, as well as identifying areas requiring further improvement. 

Considerable planning and preparedness efforts have been underway to address shortfalls 
identified in previous TOPOFF exercises and during real-world events. The exercise clearly 
identified places where the nation’s preparedness has improved. It also identified a considerable 
number of areas that need further improvement. These improvement areas include recurring 
themes — issues that have been identified in previous TOPOFF exercises and real-world events - 
along with several new areas highlighted by this scenario. 

At the AAC held on January 15, 2008, participating agencies met to review the findings and 
recommendations in this AAR and draft corrective actions. The IP included in Appendix A lists 
tlie con'ective actions. The DHS NEP has established a process for tracking and monitoring the 
implementation of these con'ective actions. 
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Appendix B: Acronyms 

Table B.1: Acronyms 


Acronym 

Meaning 

A AFC 

Agriculture Canada 

AAR 

After- Act ion Report 

ACE 

U.S. Army Corps of Engineers 

ACS 

Australian Customs Service 

AcTIC 

Arizona Counter-Terrorism Information Center 

ADHS 

Arizona Department of Health Services 

AFP 

Australian Federal Police 

AGD 

A tto m ey - General ' s Dep ar tmen t ( Aus trai i a ) 

AMS 

Aerial Measuring System 

ANSTO 

Australian Nuclear Science and Technology Organisation 

AOC 

Agency Operations Center 

ARC 

American Red Cross 

ARPANSA 

Australian Radiation Protection and Nuclear Safety Agency 

ARRA 

Arizona Radiation Regulatory Agency 

ASD^HD 

Assistant Secretary of Defense for Homeland Defense 

ASIO 

Australian Security Intelligence Organisation 

ASU 

Arizona State University 

ATF 

Bureau of Alcohol, Tobacco, Firearms, and Explosives 

BOC 

Business Operations Center 

CAT 

Crisis Action Team 

CBSA 

Canadian Border Services Agency 

CDC 

Centers for Disease Control and Prevention 

CEWG 

Control and Evaluation Working Group 

CI/KR 

Critical Infrastructure/Key Resources 

CIC 

Citizenship and Immigration (Canada) 

CIR 

Critical Information Requirement 

CMHT 

Consequence Management Home Team (DoE NNSA) 

CMHT/OR 

Consequence Management Plome Team for the Oregon Incident 

CMRT 

Consequence Management Response Team (DoE NNSA) 

CNSC 

Canadian Nuclear Safety Commission 

COGCON 

Continuity of Government Readiness Conditions 

CONPLAN 

Concept of Operations Plan 

COOP 

Con t i n u iiy of 0 perati o n s 

COP 

Common Operating Picture i 
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COSIN 

Control StatT Instructions 

CRCL 

Civil Rights and Civil Liberties (DHS) 

CSE 

Comn^uni cat ions Security Establishment 

CSG 

Counterterrorism Security Group 

CSIS 

Canadian Security Intelligence Service 

CST 

Civil Support Teams 

CWG 

Cyber Workijig Group 

D 

Detonation 

D/As 

Depar tme nts/ Age nc ie s 

DEST 

Domestic Emergency Support Team 

DhAlT 

Department of Foreign Affairs and International Trade (Canada) 

DFAT 

Department of Foreign Affairs and Trade (Australia) 

DHS 

Department of Homeland Security 

DIAC 

Department of Immigration and Citizenship (Canada) 

DND 

Department of National Defence (Canada) 

DoC 

Department of Commerce 

DoD 

Department of Defense 

DoE 

Department of Energy 

DOHA 

Department of Health and Ageing (Australia) 

DoL 

Department of Labor 

DoS 

Department of State 

DoT 

Department of Transportation 

DRG 

Domestic Readiness Group 

DSAT 

DHS Situational Awareness Team 

EAWG 

External Affairs Working Group 

ECC 

Emergency Command Center 

EMA 

Emergency Management Australia 

EMG 

Emergency Management Group 

EMS 

Emergency Medical Services 

ENDEX 

End of Exercise 

EOC 

Emergency Operations Center 

EOD 

Explosive Ordnance Disposal 

EPA 

Environmental Protection Agency 

EPA NCERT 

EPA National Counter Terrorism Evidence Response Teams 

EPA RERT 

EPA Radiological Emergency Response Team 

ERT 

Emergency Response Team (FEMA) 

ESC 

Executive Steering Committee 

ESF 

Emergency Support Function 

EVALPLAN 

Evaluation Plan 
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EXPLAN 

Exercise Plan 

FBI 

Federal Bureau of Investigatitm 

FCO 

Federal Coordinating Official 

FCO 

Foreign Sl Commonwealth Office (United Kingdom) 

FD 

Fire Department 

FDA 

Food and Drug Administration 

FEMA 

Federal Emergency Management Agency 

FOUO 

For Qtticial Use Only 

FRMAC 

Federal Radiological Monitoring and Assessment Center 

FSE 

Full-Scale Exercise 

GFP 

Guam Fire Department 

CIS 

Geographic Information System 

GOC 

Government Operations Centre (Canada) 

GPD 

Guam P{>lice Depaitment 

HAZMAT 

Hazardous Materials 

HHS 

Department of Health and Human Services 

HMRT 

RAZMAT Response Team (FBI) 

HMRU 

HAZMAT Response Unit (FBI) 

HSAS 

Homeland Security Advisory System 

HSC 

Homeland Security Council 

HSEEP 

Homeland Security Exercise and Evaluation Program 

HSIN 

Homeland Security Information Network 

IAS 

Internationa) Assistance System 

IC (Canada) 

Industry Canada 

IC 

Incident Command 

IC 

Intelligence Community 

ICE 

Immigration and Customs Enforcement (DHS) 

ICLN 

Integrated Consortium Laboratory Network 

ICP 

Incident Command Post 

ICS 

Incident Command System 

IDETF 

Inter-Departmental Emergency Task Force 

IMAAC 

Interagency Modeling and Atmospheric Assessment Center 

IMPT 

Incident Management Planning Team 

IND 

Improvised Nuclear Device 

lOF 

Interim Operating Facility 

JP 

Improvetnent Plan 

IWG 

Intelligence Working Group 

JFO 

Joint Field Office 

JIC 

Joint Information Center 
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US 

Joint Information System 

JOC 

Joint Operati on s Ce n le r (FB I ) 

JTF-HD 

J 0 i n t T ask Fo rce - H o me 1 an cl Def en se 

LD/HD 

Low Density /High Demand 

LEO VCC 

Law Enforcement Online Virtual Command Center 

LNO 

Liaison Officer 

LRN 

Laboratory Response Network 

LTR 

Long-Term Recovery 

MSEL 

Master Scenario Events List 

NCC 

National Crisis Committee (AuslTalia) 

NCR 

National Capital Region 

NED 

National Exercise Division 

NGO 

Non-governmental Organization 

Nice 

Natitnial Infrastructure Coordinating Center 

NICCL 

National incident Communications Conference Line 

NIH 

National Institutes of Health 

NIMS 

National Incident Management System 

NJIC 

National Joint fnfonnation Center 

NNSA 

National Nuclear Security Administration 

NOAA 

National Oceanic and Atmospheric Administration 

NOC 

National Operations Center 

NORTHCOM 

U.S. Northern Command 

NPS 

National Planning Scenario 

NRAT 

Nuclear/Radiological Advisory Team 

NRCan 

Natural Resources Canada 

NRCC 

National Response Coordination Center 

NRF 

National Response Framework 

NRP 

National Response Plan 

NSC 

National Security Committee of Cabinet (Australia) 

NSC 

N ati on al S ecuri ty Counc i 1 

NWS 

National Weather Service 

OCD-GHS 

Office of Civil Defense - Guam Homeland Security 

ODNI 

Office of the Director of National Intelligence 

OIP 

Office of Infrastructure Protection (DHS) 

OPA 

Office of Public Affairs (DHS) 

OSC 

On-Scene Coordinator 

OSHA 

Occupational Safety and Health Administration 

PACOM 

U.S. Pacific Comm£ind 

PFO 

Principal Federal Official 
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PFR 

Portland Fire and Rescue 

PIO 

Public InfonTiaLion Officer 

PM&C 

Department of Prime Minister and Cabinet (Australia) 

POC 

Point of Contact 

POD 

Partnership and Outreach Division 

POEM 

Portland Office of Emerj^ency Management 

PPB 

Portland Police Bureau 

PSC 

Public Safety Canada 

PSCC 

Protective Security Coordination Centre (Australia) 

PSO 

Private Sector Of! ice 

PSWG 

Private Sector Working Group 

PWGSC 

Public Works and Government Services Canada 

RAP 

Radiological Assistance Program (DoE) 

RCMP 

Royal Canadian Mounted Police 

ROD 

Radiological Dispersal Device 

REAC/TS 

Radiation Emergency Assistance Center/Training Site (DoE NNSA) 

REOC 

Regional Emergency Operations Center (EPA) 

RFI 

Request for InfoiTuation 

RISC 

Regional Interagency Steering Committee 

RPS 

Radiation Protection Services (Oregon) 

RRCC 

Regional Response Coordination Center (FEMA) 

SAC 

Special Agent in Charge (FBI) 

SBA 

Small Business Administration 

SC 

Service Canada 

SEO 

Senior Energy Official 

SEOC 

State Emergency Operations Center 

SFLEO 

Senior Federal Lav^ Enforcement Official 

SIMCELL 

Simulation Cell 

SIOC 

Strategic Information and Operations Center (FBI) 

SITREP 

Situation Report 

SL 

Senior Leadership 

SLG 

Senior Leadership Group 

SME 

Subject Matter Expert 

SO 

Senior OlTicial 

SOP 

Standard Operating Procedure 

SIR 

|{b)f6) 1 Recovery 

STRATCOM 

U.S. Strategic Command 

SVTC 

Secure Video Teleconference 

SWAT 

Special Weapons and Tactics 
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SWG 

Scenario Working Group 

T2 

Top Official's 2 

T3 

Top Officials 3 

T4 

Top Officials 4 

TC 

Transport Canada 

TCL 

Target Capabilities List 

TOPOFF 

Top Officials 

TPEP 

TeiTorism Prevention Exercise Program 

TSA 

Transportation Security Administration 

TTP 

Tactics, Techniques, and Procedures 

rrx 

Tabletop Exercise 

UA 

Universal Adversary 

UC 

Unified Command 

USAR 

Urban Search and Rescue 

USCG 

U.S. Coast Guard 

USDA 

U.S. Department of Agriculture 

USG 

United States Govermnent 

VA 

Dcptirtment of Veterans Affairs 

VAMC 

Veterinary Medicine Advisory Committee 

VIPR 

Visible Intermodal Protection and Response 

VNN 

Virtual News Network 

VSIN 

VA Network 

VTC 

Video Teleconference 

WMD 

Weapon of Mass Destruction 
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Appendix D: Timeline of Key Exercise Events 


Figure D.1 : Key Events (October 15, EOT) 
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Figure D. 2: Key Events (October 16, 0001 - 1600 EOT) 
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Figure D. 3: Key Events (October 16, 1600-2400 EOT) 
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Figure D.4: Key Events (October 17, EOT) 
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Figure D.5: Key Events (October 18-20 EOT) 
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Annex 1 : Exercise Design and Development 

This Annex is provided to summarize key issues and observations noted during the portion of the 
A AC focused on the design and development process of the T4 exercise. Under the guidance of 
the T4 ESC, working groups were formed at the national level to support the design and 
development process with the support of participating D/As within the NCR. These working 
groups were replicated at each venue to provide key planners the required insight and 
background for exercise development at the regional, state, territorial, and local levels. 

The overall T4 exercise design and development process consisted of identifying capabilities, 
tasks, and objectives; designing the scenario; developing documentation; coordinating external 
affairs events and logistics; planning exercise conduct; and selecting an evaluation and 
improvement methodology. A summary of the key observations (strengths and areas for 
improvement) noted by each of the working groups and venue sponsors during and following the 
AAC are provided in the paragraphs below. 

Prevention Component 

Strengths: 

• The significant level of commitment and play by state and local law enforcement 
participants to the expanded prevention element added a new and necessary element to 
the TOPOFF exercise package. State and local law enforcement, along with in- venue 
federal entities (most notably, FBI field offices in Guam, Phoenix, and Portland) 
devoted time and resources to exercise planning and conduct. 

• The structure and duration of the prevention component allowed for immediate “return 
on investment” to the participating agencies. The areas for improvement identified 
during the prevention element allowed players to attempt to resolve issues and 
improve capabilities during the response portion that followed. 

Areas for Improvement: 

• Some elements of prevention play were limited by the need to constrain the scenario 
and roll into the response phase. Although discrete prevention successes were 
developed that did not interfere with the response scenario, some constraints required 
by the follow-on response exercise prohibited full realistic and comprehensive 
prevention play. 

• Fiscal constraints kept some agencies from providing optimum commitment to the 
prevention scenario. Some elements of the scenario were overly focused at the state 
and local law enforcement level due to the inability of federal agencies in the NCR to 
commit to full play. Attempts to simulate federal play were not always adequate to 
generate a realistic environment for participating law enforcement agencies at the 
state, territorial, and local level, 

• The prevention component needs to be more effectively coordinated with the IWG. 
Better coordination will allow prevention play to incorporate more D/As that would 
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support real-world prevention activities. Better integration of the intelligence effort 
would also support the requirement for improved coordination/ visibility across 
unclassified and classified infonnation systems. During exercise execution, better 
integration of prevention and intelligence MSELs would provide more effective 
training for participating agencies. 

• Future prevention exercises should consider what other entities (e.g., the private 
sector, public safety professionals, etc.) would be impacted by the information and 
intelligence that is gathered and shared during the lead up to the response element. 
These additional factors should be accounted for in the integrated MSEL development 
of the prevention exercise. 

Scenario Working Group 

Strengths: 

• In NPS-1 1 , "...the Universal Adversary’ (UA) purchases stolen cesium chloride to 
make a radiological dispersal device (RDD), or 'dirty honih . ' The explosive and the 
shielded cesium 137 { 137Cs) sources are smuggled into the U.S. Detonator cord is 
stolen from a mining operation, and all other materials are obtained legally in the 
United States. Devices are detonated in three separate, but regionally close, 
moderate-to-large cities.” With this substantive scenario as its foundation, the SWG 
was able to adapt the overarching T4 objectives into a plausible and effective exercise 
scenario. The NFS provided an appropriate level of technical and operational 
specificity, yet adequately accommodated the unique directions provided by the T4 
ESC to allow the SWG to tailor the story to specific requirements provided by the 
federal, state, tern tori al, and local participants. 

Areas for Improvement: 

• The ESC directed the SWG to lock the scenario on July 2, 2007. Despite this, several 
organizations made changes or additions to the scenario to support their organizational 
objectives without informing the SWG. While most of these changes were eventually 
accommodated, changes made after the designated locking of the scenario resulted in 
extensive re-work. 

• Elements of the Ground Truth relating to technical or physical aspects of the simulated 
source material acquisition, transportation, and weapon construction required subject 
matter expertise and consultation. While help from several key federal D/As and 
national laboratories was provided, it was offered on an ad-hoc, voluntary basis. 
Responsibility for this expertise was never officially assigned or accepted. The lack of 
accountability resulted in an ill-defined level of technical expertise and support. 

• Designated D/As with recognized subject matter expertise should be ultimately 
responsible for developing of the Ground Truth technical details required to support 
the scenario. Ground Truth details should include technical details about weapons 
systems and effects, characteristics of UA individuals and organizations, and detailed 
information essential to law enforcement investigation. A dedicated group focused on 
the Ground Truth should be set up to augment the work of the SWG to ensure the 
integration, de-confliction, and validation of required information. 
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Intelligence Working Group 

Strengths: 

• Controllers, evaluators, and observers noted the very good cooperation at all levels 
within IWG. During exercise execution, communication among controllers within the 
ICC was free flowing and could be an example of how intelligence agencies, defense, 
and law enforcement could work together in a centralized fusion center. 

• The Scripting Conferences facilitated by the IWG provided a forum where all 
participating representatives could provide input and comment on key intelligence- 
related aspects of the scenario that could not be discussed at SWG meetings due to 
their classification. Because the overall script at the national level generally remained 
unchanged, there were few disconnects due to scripting and writing of ad-hoc events. 

• Access to SVTCs conducted during the exercise by the CSG was invaluable for the 
ICC. This insight allowed ICC controllers to monitor player action and response to 
intelligence implementers in real time. 

Areas for Improvement: 

• A chairperson for the IWG should be designated who would be responsible for 
defining the intended level of effort of each member organization, including 
instructions, roles, responsibilities, and milestones. Additionally, the IWG chairperson 
and staff should identify the intelligence community controller and evaluator staffing 
requirements early in the exercise design process to help planning continuity. 

• There was an inadequate level of realistic “white noise” in the intelligence database 
system to plausibly replicate a real-world threat stream. Incoiporating additional 
information not critical to the scenario’s main threat stream would provide players and 
analysts with a more challenging and complex intelligence picture. This information 
should be incoiporated more effectively into the UA database. 

• A DHS exercise portal and web-ba.sed content management system similar to the 
Extranet Secure Portal (ESP) should be created based upon other more commonly 
used Homeland Security classified and unclassified networks (e.g., HSIN, HSDN, and 
C-LAN/JWICS). These systems should provide role-based access to appropriate 
intelligence, defense, and law enforcement users by exercise. 

• A law enforcement working group should be considered in order to encourage better 
integration of the intelligence and law enforcement communities. 

• Further development and funding of the UA database would provide a more realistic 
threat stream for intelligence exercise support. Ideally this database would be housed 
within a national-level SIMCELL. 

• Coordination of international partners’ integration into intelligence planning early in 
the exercise planning process is integral to the realistic representation of information 
sharing. Early miscommunication among U.S. and partner nation planners resulted in 
an unrealistically restricted information sharing process. 


Annex 1 : Exercise Design and Development 


1 05 


U.S. Department ot Homeland Security 


For Off i c i a l Use Only 


For Off i c i a l Us e Only 

National Exercise Program (NEP) 


After-Actton Report / 

Improvement Plan (AAR/IP) Top Officials 4 (TOPOFF 4) 


International Working Group 

Strengths: 

• The International Working Group was a successful forum for c 
international partner participation with U.S. government D/As. This coordination was 
further facilitated by scheduling International Working Group meetings to coincide 
with DHS National Planning Seminars and T4 planning conferences. 

• International participation in National Seminars and planning conferences allowed key 
partner nation representatives to learn more about U.S. emergency response policies 
and procedures. Additionally, their participation provided U.S. federal, state, and local 
representatives with valuable insight into the international dimension of domestic 
incidents, and fostered bilateral working relationships that are key to response and 
recovery activities. 

• The early establishment of international and DoS objectives facilitated focused 
exercise planning and participation, and supported the deployment of a DoS 
representative and international consular officials to Portland. Exercising the consular 
affairs aspect of emergency response was new to TOPOFF and added realism to live 
play. 

• The creation of the Quadrilateral Public Affairs Agreement among the four 

participating nations during exercise planning facilitated information sharing among 
key U.S. and partner nation players. - ' 

Areas for Improvement: 

• Unlike T3, when international partners conducted domestic exercises, there were no 
terrorist events in the partner nations during T4. International planners agreed that 
events in partner nations related to the U.S. domestic incident would drive more 
realistic play for international players, vs. only reacting to a U.S, domestic event, 

• Given the wide disparity in time zones, the lack of consistent 24/7 exercise play in all 
venues hindered the full integration of international play and response efforts. 
Additionally, levels of play among partner nations and U.S. role players varied widely, 
impacting exercise realism. 

• Federal identification of international partner nations and international observer 
nations earlier in the planning process would facilitate exercise and observer program 
activities. 

• Procedures for sharing '‘For Official Use Only” (FOUO) documents with international 
partners were established on a delayed basis. Planners should have these procedures 
in place early, in the event that future international partners go beyond Australia, 
Canada, and the United Kingdom. 

• No more than three international partner nations should be considered for future NLEs 
because of finite USG resources and ability to incorporate international participation in 
domestic play. 
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Private Sector Working Group 

Strengths: 

• The defined schedule of meetings helped paitici pants to follow the progression of 
exercise design. The support and materials provided by the DHS team allowed private 
sector entities to continue the development of key issues and to integrate the efforts of 
the other exercise working groups. 

• The T4 experience gave exercise planners an appreciation for the breadth and depth of 
private sector capabilities to recover from a crisis. Awareness was raised in key areas 
including supply chain issues, operational shortfalls, and public-private sector incident 
management system relationships. The different levels of participation, (e.g., TTX, 
Looking Glass, or SIMCELL) provided organizations with choices. 

• The exercise provided participating agencies with opportunities to learn about and 
expand existing methods of integrating national-level policies (e.g., NIMS) into 
private sector processes. The exercise illustrated the need for additional clarity on 
information sharing materials and processes required in emergency situations. 

Areas for Improvement: 

• Private sector integration and engagement needs to be continually expanded and 
developed. In order to integrate the objectives of private sector entities, NGOs, and 
special needs organizations, input should be sought much earlier in the planning 
process. There should be careful planning about when and where participation should 
be included. This integration would support scripting of MSEL injects to ensure both 
realism and relevance to real-world situations. 

• The term “private sector” lacks a clear definition. There should be clear distinction 
between the level of participation of CI/KR entities and their representative 
organizations (Partnership for Critical Infrastructure Security/PCIS), individual large 
corporate partners (e.g., Wal-Mart, Boeing, Cisco Systems, etc.), NGOs and voluntary 
organizations, and state and local business partners. Each of these distinct 
representatives of private sector interests would have different objectives and 
requirements for participation in national-level exercise events. 

• Although great progress was made to include large private sector entities, there was 
inadequate participation by NGOs and local service organizations. This resulted in a 
significant gap in human services delivery during response and recoveiy. Local NGOs 
and voluntary organizations are most familiar with the types of support needed to 
maintain the population's physical and mental well-being. Local organizations are the 
foundation for long-term recovery and should be encouraged to participate early in the 
planning process. 

• Security and handling of official documents used by the private sector should be 
established early in the process to be fully understood, appreciated, and implemented 
by all participants. Policies should address requirements for and restiictions on 
document sharing and disclosure limitations for sensitive information. A designated 
team with specific disclosure control responsibilities would be most effective. 
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• Many exercise terms (e.g., “planner”, “controller”) may not be familiar to private 
sector entities, NGOs, or special needs exercise participants. An “Exercise 101” course 
should be made available to support their involvement in the exercise process. 

Control and Evaluation Working Group 

Strengths: 

• The expanded attention to MS EL development by a broader cross section of D/As led 
to the creation of a more complex and realistic exercise in many targeted areas of 
interest. Several organizations at the federal level that had not previously participated 
in TOPOFF took the opportunity to develop MSEL events that stressed defined 
training objectives. MSEL injects supporting special needs populations, international 
consular affairs issues, and Cl areas were noteworthy. 

• Increased access to federal operations centers - especially the placement of evaluators 
in the NOC - led to more insightful evaluation and analysis. Evaluators were able to 
observe the multi-tasking done by the IMPT and the NOC CAT. Enhanced access to 
the NOC and other key operations centers allowed the evaluation team to better assess 
processes across the specbum of federal, state, and local participating agencies. 

• Due to the exceptional efforts of the FBI Tactical Response Unit, access to classified 
communications systems was available for the first time in a TOPOFF exercise at the 
same location as the MCC. The portable systems installed by the FBI allowed the 
exercise directors and their key leadership teams to communicate in real time with the 
ICC and numerous DoD and law enforcement elements of the exercise control 
structure. 

Areas for Improvement: 

• Attendance at the NCR Working Group meetings and training sessions was limited. 
Exercise planning teams need to redefine the objectives of the CEWG and lay out 
specific milestones and timelines during the planning process, A defined schedule 
would contribute to an effective control and evaluation architecture that could begin 
with a small focused group that grew in attendance and responsibilities as exercise 
execution approached. 

• HSEEP guidance should be reviewed to ensure that it effectively addresses and 
supports the unique requirements and level of participation expected in a Tier 1 NLE. 
Current guidance does not adequately address the full spectrum of interagency 
participation at the highe.st federal level. 

• The cuiTent process of planning, developing, executing, and evaluating TOPOFF is not 
linked to a common training program that would teach knowledge, skills, and abilities 
to the “top official” target audience. Training standards are established and 
administered for operational and tactical participants by their own agency or 
governmental authority, but strategic decision makers at all levels of government 
receive information and knowledge on an ad-hoc basis. A training program linked to 
the NLE would significantly enhance the participation and success of “top officials” in 
the NEP. 
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• The continued development of a standing DHS exercise control cell facility with 
classified and unclassified IT connectivity is essential to exercise quality and 
continuity. The current need to build the control architecture, (i.e., computers, video 
projection, telephones, etc.) just prior to exercise execution intensifies the demanding 
work of supporting an NLE. An adaptable MCC that could be expanded or contracted 
as exercise requirements dictate would provide a greatly improved capability to 
support interagency federal, state, and local training and exercise objectives. 

• Additional emphasis must be put on synchronizing the MS EL, particularly events that 
affect multiple agencies. These synchronization efforts should be incorporated into the 
planning during CEWG meetings at both the national and venue level. 

• The training plan for controllers and evaluators should be expanded. The complexity 
of the Tier 1 exercise program requires more extensive training tailored to the specific 
requirements of each exercise venue. If controllers and evaluators could be identified 
earlier in the exercise planning process, a control and evaluation training schedule 
could be integrated into the venue visit and interagency group meeting schedules. 

• The development of a more extensive SIMCELL within the MCC and VCCs would 
enhance the realism for many participating agencies needing to interact with specific 
departments, agencies, or organizations that are not scheduled to participate (e.g., 
adjacent jurisdictions, NGOs and special needs agencies). Additional coordination 
with key planners would help to identify organizations that should be represented and 
ensure that training objectives can be more effectively met. 

• Experienced .senior-level controllers should be carefully selected to support deputies 
and principals meetings and ensure that high-level exercise objectives are being met. 
They could prompt or re-direct players towards decisions that had been scripted for 
exercise purposes. For example, no formal decision was reached to deploy the DEST 
after the October 1 6, 2007 senior leadership morning meetings. However, the 
requirement to deploy the DEST had been previously planned to support numerous 
other training objectives. An experienced and qualified controller could have stepped 
in during the meeting and reviewed the situation with the participants to illustrate that 
the specific decision to deploy the DEST to Oregon would achieve exercise objectives. 

Cyber Working Group 

Strengths: 

• The CWG promoted good coordination and information- sharing among the various 
federal D/As, as well as private sector participants. 

• The CWG created various exercise documents that promoted a realistic approach to 
cyber play for participants in the FSE. 

• The coordination and management of exercise injects with federal D/As was 
coordinated well. 

Areas for Improvement: 

• There was inadequate coordination and information-sharing between the CWG and 
other T4 working groups during the planning phase, especially the IWG. This less- 
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than-optimal integration hindered the training opportunity and critical information that 
was disseminated among interagency D/As and other key stakeholders during the FSE. 

• There was inadequate intra- and inter-jurisdictional coordination at the federal and 
state levels of cyber- and common icati on s-related information resulting in unnecessajy 
challenges for integration of injects into the FSE. 

External Affairs Working Group 

Strengths: 

• The early participation of a wide cross-section of federal public affairs representatives 
enhanced the public affairs level of play throughout the exercise. The designation of 
ESF-15 leads and interagency participation (e.g., FEMA, FBI, ATF, ACE, USCG) 
supported an effective networking opportunity for problem solving and planning. 
Venue visits by federal representatives from DHS OPA, FEMA, USCG, and the FBI 
enhanced the interaction between federal and regional or venue counterparts and 
supported the development of public affairs-focused tabletop and conference call 
exercises in the weeks preceding the FSE. In total, approximately 450 public affairs 
representatives participated “inside” the FSE. 

• National Seminar 2 was completed dedicated to the external affairs function. Public 
affairs representatives from all three venues, international partners, and most federal 
agencies participated. Well-received presentations on public health, special 
populations, law enforcement, ESF-15 and risk communications provided a basis for 
outstanding information exchange, training, and exercise planning. The seminar was 
replicated in all three venues to provide regional, state, territorial, and local public 
affairs representatives with similar opportunities for information exchange and 
training. 

• The VIP/Observer program designed by the EAWG provided an opportunity for over 
400 domestic and international observers (representing 17 nations) to witness response 
efforts, share infonnation, and collaborate on future preparedness and training efforts. 
By developing daily themes during exercise play, the program was designed so that 
observers could view different parts of the response effort as events unfolded. Among 
the elements of the program were infonnation exchange opportunities and tours at 
incident sites, healthcare facilities, non-governmental agency support locations, and 
federal, state, teiTitorial, and local EOCs. 

• Allowing international VIPs and observers to be fully integrated with the DHS 
observer program gave them a unique perspective on the exercise and U.S, domestic 
incident response activities, and should be included in future NLEs. 

• The real-world media program involved the coordination of daily media activities in 
each venue to manage media inquiries about the exercise. The program allowed media 
to observe various parts of the exercise while maintaining exercise integrity. More 
than 170 members of the media covered the FSE. Media coverage raised the visibility 
of the program and DHS. The exercise was covered by all local print and broadcast 
sources and several national news sources including CNN, MSNBC, the Associated 
Press, and The Washington Post. 
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Areas for Improvement: 

• The wide range of duties and demands on the public affairs teams to support the 
external aspects of the exercise limits their ability to actually participate “inside” the 
exercise. During T4, the DHS OPA had responsibility for coordinating public affairs 
play within the exercise as well as the VIP/Observer program. DHS/FEMA public 
affairs had responsibility for real-world media coordination. These important demands 
outside the exercise limited public affairs representatives’ ability to respond to the 
demands of VNN and notional media requirements and to meet the public affairs 
training objectives presented by the exercise itself. 

• There could be an even more effective public messaging campaign during the planning 
phase of the exercise to explain the NEP and the tiered concept of exercise events, 
particularly the comprehensive nature of the Tier 1 TOPOFF series. This program 
could include press releases surrounding the national seminars and planning 
conferences and other milestone planning events. 

• Thirty-seven countries and international organizations were invited to send two 
representatives each to the observer program, but several countries sent more than two. 
To effectively manage invitations, the number of countries and international 
organizations for future NLEs should not exceed thi s number. The number of reserved 
spaces for each observer country should be increased to three. Invitations should still 
request only two, but by reserving a larger number, a hidden margin would be built in 
to allow countries to send more representatives. 

Virtual News Network (VNN) 

Strengths; 

• The VNN team provided 195 live segments of broadcast during the FSE. These events 
included coverage of events, press conferences, interviews, and on-scene updates from 
all three venues and the NCR (across 14 time zones). VNN adds realism to the 
exercise, holds decision makers accountable, and provides a valuable way to provide 
timely injects that move the scenario forward. 

• VNN footage can be used in the future to support numerous DHS/FEMA tabletop or 
functional exercise requirements. 

Areas for Improvement: 

• The VNN Live broadcast hours (12:00 Noon - 8:00 p.m. Eastern Time) were designed 
to be.st support all three venues, given funding considerations. The lack of 24-hour 
coverage did weaken the intensity of play when the broadcast was not on the air. 

• There was no posting of fact sheets or press releases on VNN.com throughout the 
night (Eastern Time). 

• The positive contribution to the exercise provided by VNN is demonstrated by the 
demand among participants and players for an expanded simulated media product 
(e.g., competing networks, blogs, web pages, etc.). 
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Venue Observations and Recommendations 

The participation of thousands of planners, controllers, evaluators, and exercise participants at 
the three T4 venues was a critical element of success for the entire training audience. During the 
AAC, T4 venue representatives were asked to provide summary obseiwations of the exercise 
design and development process from a venue perspective for the interagency participants. The 
paragraphs below provide an overview of the most noteworthy discussion points and 
recommendations for consideration by future venue planners and those teams responsible for 
support tn the venues. More extensive discussion and documentation of venue exercise design 
issues has been conducted with venue leaders and planners for use in future exercise planning 
efforts. 

Arizona 

Discussion Points and Recommendations: 

• Level of Play: Determine the level of play of participating communities and agencies 
as early as possible, and recommend that similar size communities support similar 
levels of play. 

• Benchmarks; Venue planners should set guidelines and benchmarks for levels of 
participation to ensure that there is an adequate cost/benefit to support. Even when a 
community or organization commits to only a short period of participation, there is 
still considerable effort required to ensure that a training benefit is achieved. Personnel 
requirements for the agreed-upon level of support should be established early in the 
planning process. 

• Mentor Program: Establish and maintain the TOPOFF mentor program among 
previous participating venue representatives. The expertise provided by the,se venue 
counterparts provides a unique insight into important exercise planning elements and 
more importantly, supports real-world best practices development. 

• Venue Visit Schedules: Consideration .should be given to modifying the duration of 
visits by venue support teams to optimize the use of their time. Especially when there 
are travel requirements within the venue (e.g., Phoenix to Tucson), consideration 
should be given to extending visits to best accommodate planning efforts. 

• Workshops: Schedule a designated training objective workshop for participants early 
in the planning process and hold agencies and communities accountable for defining 
their participation level based upon those objectives. 

• Local Federal Representatives; Institutionalize a program to engage local and 
regional federal representatives from early planning through ENDEX. The 
participation of these regionally-based federal resources provides a critical link to their 
respective NCR-based D/As and facilitates important relationship building that will 
continue well after exercise completion. 
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Guam 

Discussion Points and Recommendations: 

• Mentor Program: The vital benefit provided by the mentor program to the TOPOFF 
planning process was never fully utilized during T4 planning. Learning from a former 
state or territorial planner about his or her experiences when prepaiing for and 
executing TOPOFF would have provided a unique advantage to the planning process 
and would have enhanced the exercise. DHS should present the mentor program to the 
venues and clearly define which specific opportunities each venue can lake advantage 
of during the TOPOFF planning process. The mentor program should be open to any 
former TOPOFF planners, not only those from the most recent TOPOFF exercise. 

• Venue Seminars and Conferences: Seminars and planning conferences are vital 
elements of the exercise planning process. During the T4 planning cycle, the venue 
conferences and seminars were intended to follow the format and topics of the 
preceding national conference and seminars. Although the format and topics of the 
national events were closely followed in each of the venues, many federal 
presentations were not conducted by the most appropriate speakers. Many times, 
venue planners had to present federal presentations due to the lack of federal 
representation. This circumstance proved to be a disadvantage to those venue-based 
planners who had not had the opportunity to attend the national conferences and 
seminars. In order to provide additional exposure and integration among the venues, 
consideration should be given to holding the national conferences and seminars at 
venue locations, similar to the events conducted during the T3 planning process. This 
will also give the federal presenters and participants the opportunity to visit the venues 
and meet with the local and regional federal planners. 


Oregon 

Discussion Points and Recommendations: 

• Level of Play: During the exercise design and development hot wash, several agencies 
commented that their level of play depended on other agencies’ level of play. The 
consequence of this “wait-and-see” decision model was that agencies arrived at level 
of play commitments that were not always aligned with exercise budget decisions that 
had been made several months (or years) earlier. Additionally, some agencies made 
level of play decisions that were dependent on the commitment of other non-affi hated 
agencies. These agencies were not always prepared to meet the demands of the 
exercise. Since many agencies did not commit to their level of play until very late in 
the planning process, these interdependencies were not always identified in time. One 
reason behind some agencies failing to establish a firm level of play was the late 
development of the national -level federal agency objectives. This caused the regional 
federal agencies to delay making commitments and thus affected the work of the other 
local planners. Establishing an agency’s exercise level of play, determining their 
exercise objectives, and developing an exercise budget were all identified as critical 
planning elements. Each of these elements has a direct effect on the others. All of 
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these items need to be decided at the earliest point possible during the exercise 
planning process, 

• Real-World Media and VIP Visits During Exercise Play: During the exercise, real- 
world media opportunities were planned that competed for time with the participation 
of several top official players. During the peak of exercise play, several key players 
were at the exercise site addressing the media. While this was an effective forum for 
presenting the exercise to the media, it had some negative consequences for exercise 
play. (For example, the governor was unable to sign a disaster declaration in timely 
manner; the PFO was not in Bothell or Salem to meet with players, etc.) Several 
observers and members of the media toured various exercise EOCs. The visit of one 
VIP pulled the City of Portland EOC manager away from exercise play and caused the 
POEM EOC to miss an early critical planning conference call with the .state and 
county EOCs. One VIP visit to the Rapid Screening Point was cited as an example of a 
visit with a direct negative impact because it distracted the exercise training audience 
from their focus on exercise objecti ves. The visit halted the two-hour exercise play for 
,^0 minutes causing the players to fall well short of their throughput goals. While all 
planners agreed that it was important for local elected officials to take time to deliver 
positive messages to the public about the exercise, due consideration should be given 
to the impact that removing the officials from play could have on the exercise. There 
were various suggestions about how this could be approached in the future to 
minimize the effect on the exercise. One suggestion was for elected officials to pre- 
brief the media prior to the STARTEX and then remain totally inside the exercise for 
the remainder of the event. Another suggestion was that elected officials could appoint 
a spokesperson to update the media throughout the exercise, A third suggestion was to 
take all media events to a segregated area near but separate from the exercise site. For 
example, the media area at the PIR site worked well and provided the media with a 
good backdrop while not interfering with the exercise. This was in contrast to the 
Rapid Screening Point and some EOCs where the observers, media, and press events 
were allowed to mix with the exercise players. This mixing often resulted in 
significant interference with the exercise. Thorough planning of VIP/Observer and 
real-world media events is essential to ensure that these important elements of the 
exercise do not have an undue or unanticipated impact on the actual "‘inside the 
exercise” training opportunity. 
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Annex 2: Customs and Border Patrol AARs 


Office of Intelligence and Operations Coordination 
Operations Coordination Division 



US. Customs and 
Border Protection 


AAR for T4 National Emergency Preparedness Exercise 


Background: T4 is a congressional ly-raandated national emergency preparedness and response 
exercise conducted every two years, involving every federal agency and a variety of state and 
local authorities. The T4 scenario presented for this year’s exercise involved the terrorist 
detonation of radiological material (Cesium-137) in three separate venues (Guam; Phoenix, 
Arizona; and Portland, Oregon). The exercise was heavily weighted on response and recovery 
issues. 

Exercise Scenario: Due to the geographic location of each attack and CBP’s current operations, 
its participation was primarily limited to the Office of Field Operations, Directors of Field 
Operations (DFO) in San Francisco, California and Tucson, Arizona; and the subordinate Port 
Directors in the events venues. Each DFO and Port Director assigned specific individuals to 
actively participate in each exercise activity as a representative of CBP. 

Objectives: Headquarters (HQs) and Field 

• Use of established common response communication language to ensure that information 
dissemination is timely, clear, acknowledged, and understood by all receivers. 

• Demonstrate the ability to issue, manage, and update emergency notification systems 
under all conditions to ensure that all employees are accounted for. 

• Demonstrate the ability to activate their COOP plans, redeploy officers to alternate 
locations, account for overtime, assume post-event business resumption protocols, and 
deploy under ESP- 13, if activated. 

• Demonsti'ate the ability to activate the proper channels of communication to include 
reporting to the Commissioner’s Situation Room or as requested by HQ, reporting to 
DFO, Port Management, and Lead Field Coordinators (LFCs) in respective regions. 

• Demonstrate the ability to coordinate with other agencies and appropriate emergency 
management contacts according to agreements/policies to facilitate information sharing 
and solve issues while remaining in accordance with NIMS/NRP. 

All of the objectives were met to varying degrees and timelines. The following observations and 
recommendations will address the objectives: 

Observations and Recommendations: 

Observation: It was noted in all three venues that there was an overabundance of acronyms and 
technical terms in use that often required definition. 
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Recommendation: Use common language. The ICS principals clearly identify the requirement 
to use common language and terms. 

Observation: There was a lack of training and connectivity during the initial report of the 
incident. While local authorities attempted to engage officials of various organizations, there was 
no uniform notification system available to alert federal, state, and others to the emergency 
event. CBP largely depended on the media for notification. 

Recommendation: It is recommended that (nationally) CBP managers in all facilities develop 
and foster relationships and a means of communicating first responder alerts or notifications of 
any event within their area of responsibility. This recommendation could be as simple as creation 
of basic telephone contact trees to high-tech internet protocol-linked radio frequencies accessible 
by all authorities within an affected geographical area. 

Observation: CBP field participants were not provided with an official notification of changes 
in the HSAS threat level from Yellow to Orange and Red. The changes were provided via the 
media and local officials. 

Recommendation: For future exercises, as in real-world reporting of emergencies, an HQ 
SIMCELL should be created to provide top-down communications of official policy changes 
with the appropriate guidance. Staffing issues curtailed this activity and it was only addressed in 
a notional sense. 


Observation: There appeared to be too many EOC facilities engaged in this exercise. It was not 
practical to co-locate CBP personnel in every EOC. (State EOC, City EOC, Airport/Seapoit 
EOC, plus the JIC, JOC, and JFO.) 

Recommendation: A single centralized facility under a unified command structure would have 
streamlined the information flow, connectivity process, and communications. CBP should focus 
on the JOC first and than EOCs with a direct CBP nexus. 

Observation: CBP officers were unable to access the JOC. The JOC is operated by the FBI and 
serves as the location and activity responsible for conducting a criminal investigation of the 
event. Access to the JOC requires a secret clearance at a minimum, and the security clearance 
must be on file with the FBI at HQs. The FBI SAC of the JOC arranged for limited access for 
several CBP officers, out of recognition of the need for information related to the border crossing 
and international travel of the terrorists. 

Recommendation: LFCs should pre- identify JOC/ EOC personnel who possess appropriate 
clearances. 

Final Observation: A recurring theme discerned from all exercise venues identified the fact that 
CBP appears to operate in a vacuum. Operational activities, capabilities, authorities, and 
responsibilities are relatively unknown to many within the law enforcement or civil government 
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communities. Anecdotal reports from vai'ious sources throughout the exercise indicated a 
pleasant surprise and welcome once CBP assets arrived to assist in an activity. Issues as simple 
as the ability to detect the presence of radiation or assist with traffic control and security 
measures were resolved once CBP officers became engaged in the emergency. 

Recommendation; A greater emphasis on “CBP 101” outieach programs to the public, private 
sector entities, and community governments. 
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Office of Intelligence and Operations Coordination 
Operations Coordination Division 


US. Customs and 
Border Protection 


AAR of CBP T4 “Preventative Play” Radiation Protocol Field Testing Exercise 

Background: 

In January 2007, DHS announced the T4 National Preparedness Exercise. The premise of this 
exercise is based on terrorist-detonated RDD attacks in three geographically separate locations. 
The venues were identified as Guam; Portland, Oregon; and Phoenix, Arizona. Of particular 
interest to CBP is the exercise scenario, which scripted the smuggling of 5,000 curies of the 
radioactive isotope Cesium~137 across the southwest border from Mexico into the United States 
by the members of a terrorist organization. 

This scripting of a perceived failure by CBP was designed to permit the simulated detonation of 
the RDDs within CONUS, requiring a subsequent emergency response by various assets of the 
federal, state, and local authorities. 

Within CBP, the Offices of Anti-Terrorism, Internal Affairs, Human Resources, and Border 
Patrol coordinated to develop a “no notice” field activity, where designated role players 
attempted to pass through a U.S. Border Patrol (BP) checkpoint outside of Nogales, Arizona with 
a small quantity of Cesium- 137. 

Primary Goal of Testing: 

The primary goal of this exercise was to test CBP’s radiation detection policy and procedures, as 
well as to assess the ability and the willingness of the BP agents involved to detect, detain, and 
process a radiation-based terrorist threat. CBP leadership decided to leverage the T4 scenario and 
the supporting simulated intelligence to conduct an internal CBP exercise, which focused on 
testing CBP’s ability to respond to specific border-threat-related intelligence and to assess CBP 
radiation detection policies and procedures. Ultimately, DHS leadership agreed to include CBP’s 
internal exercise as an annex to the actual T4 exercise. 

Field Test Development 

Radioactive Field Test Material: 0.075 Mil-Rems of Cesium-137 


Training and Coordination: 

The participating role players received formal radiation safety training and certification from the 
Office of Occupational Safety and Health. In addition, a specific use permit was issued by DoT 
for movement and use of the radioactive material based on t he Nuclear Reg ulatory Commission 
(NRC) license maintained by CBP Radiation Safety Officer I The Office of 

Internal Affairs 


(bX6) 


supported the exercise by helping to coordinate the transport of the 
material via FEDEX (Dangerous Goods) and provide safety equipment for secure handling of the 
material. 
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Concealment: 

The Cesium- 137 was contained inside a standard metal shipping “pig” case with the lop removed 
and secured inside a cardboard box in a side pocket of a canvas backpack. The “pig” was 
positioned in the backpack with the unshielded beam facing the driver’s side door in the middle 
row of a Dodge mini -van. All other sides of the “pig” were provided with a lead apron covering 
to effectively shield the driver and other passengers participating in the exercise. A personal 
radiation detector (PRD) screening of the vehicle's driver’s side exterior indicated a numerical 
reading fluctuating between a 6 and 8. 



Exercise Role Players: 

1(b)(6) f 


Role Players Script: 

The role playing team posed as employees of “Care International,” which is a Northern Virginia- 
based charitable organization with suspected ties to teiTorist money laundering activities. The 
role players claimed that they were returning from a short vacation in Puerto Penasco (Rocky 
Point), Mexico, and were en-route to Tucson International Airport. Prior to the exercise, role 
players divested themselves of any and all identification and material links to government 
employment. The role players carried only some cash and local Virginia/ Maryland driver’s 
licenses. 

Actual Field Test Results: 

The field-testing exercise commenced at 1115 hrs (PDT), with the role players driving north 
approximately 12 miles out of Nogales on Arizona Highway 82, where a BP tactical checkpoint 
was encountered. The role-playing team was stopped by a BP agent who, while attempting to 
determine the citizenship of the team, recognized the audible alert and visual indicators of his 
PRD. Upon receiving this audible alert, the BP agent e.scorted the team to a secondary inspection 
area where additional BP agents were located. 

BP agents interviewed the role players briefly while in the vehicle, discussing the citizenship and 
travel of the team. The role players were requested to exit the vehicle and asked to provide 
identification while the questioning continued. The role players observed tlie BP agents 
communicate with each other and use additional PRD(s) and a Radioactive Isotope Identification 
Device (RIID) along the exterior of the vehicle. 

The role players were questioned as a group by the BP agents, who asked why radiation was 
detected and if they had any knowledge that radioactive material was in their possession. The 
role players denied having knowledge of any radioactive material and agreed to the BP agent’s 
request to search the vehicle. However, they declined a request to search personal baggage 
contained in the vehicle. 
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During the questioning, the role players were individually searched for weapons to ensure the 
safety of the BP agents. For additional safety considerations, the role players were required to 
wear radiation dosimeter badges at about chest-level for later testing and evaluation. BP agents 
did discover similar dosimeter badges on each role player during the search for weapons. The 
dosimeters found on the role players by the BP agents were not marked and there was no 
indication as to their purpose or function. Each role player individually declined to comment as 
to the purpose of the dosimeters when asked about them by the BP agents. 

The role players were then separated and escorted to individual BP vehicles for secure detention 
purposes. At this point, the BP agents began: 


• Contacting the Nogales Station to describe and identify the dosimeters 

• Researching the role players’ identification for criminal history 

• Researching the crossing data on the vehicle 

• Researching the employer organization “Care International” 

The “hot” baggage was identified and isolated. The RIID identified the material as Cesium- 137. 
The BP checkpoint Field Operations Supervisor (FOS) initiated contact with the Nogales Station 
and Laboratory Scientific Services (LSS) in preparation to transmit the isotope spectral signature 
to LSS for analysis (LSS management had been previously advised of the field testing team’s 
covert activities and was awaiting the call). 


Exercise Conclusion: 

The field testing team leader |W(^) 


identified himself and members of the role 


playing team to the senior agent on duty and requested that the he contact the exercise “trusted 
agenf ’, Assistant Patrol Agent in-Charge (APAIC) Dolph Hunt from the Nogales BP Station. 
APAIC Hunt responded shortly afterwards and member identification was validated and the 
exercise was concluded. A de-briefing and hot wash was then conducted with the entire 
checkpoint group. 


Observations and Recommendations: 

As stated previously, the primary purpose of this exercise was to highlight and demonstrate the 
capabilities of the BP to detect, detain, and process a radiation-based teiTorist threat as linked to 
the T4 National Preparedness Exercise scenario. While deemed a successful interdiction of the 
terrorist event, several “gaps” were identified during the hot wash with the BP agents: 

1. Education: Although agents effectively managed this field test, they were unsure of 
specific legal authorities and radiation properties. Basic courses should be reviewed and 
edited to ensure that they address radiation sources, the identification of types of 
radiation, specific hazards, and their legitimate uses, agents should be aware of the legal 
requirements to possess and transport radioactive material (i.e., licenses, permits, etc.) 
and also possess the capability to validate the licenses or permits. In addition, knowledge 
of the civil or criminal penalties for illegal possession of radioactive materials as well as 
an understanding of when other authorities are required to be notified should also be 
addressed. 
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• Office of Intelligence and Operation Coordination (OIOC)/ IMOC will 
coordinate with the Office of Training and Development to discuss these 
issues. 

2. Technical connectivity: Although this specific checkpoint was not considered 

permanent, all checkpoints should have the technical means necessary to transmit the 
data required by LSS without having to secure and move vehicles and suspects to a 
station. 

• OIOC/ IMOC will discuss the technical issues and coordinate with the Office 
of Infomiation Technology and Office of Border Patrol regai'ding this issue. 
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